Spotlight Search privacy in 2026: what Apple sends, and what stays local

Spotlight is one of the most-used features on macOS and one of the least-examined. Most users type ⌘Space dozens of times a day and never read a privacy disclosure. The mechanics are not secret — Apple has documentation for most of it — but the moving parts are spread across three different settings panes and several support articles. This post pulls the whole thing into one place: what is local, what is cloud, what is opt-in, what is on by default, and what each toggle actually changes.

The short version is reassuring and uncomfortable in roughly equal measure. The local index is local. The Suggestions surface is not.

Two systems with one search box

What looks like one feature inside the Spotlight panel is really two systems stitched together at the UI layer.

The first is the on-device metadata index — the mds daemon, the mds_stores writer, and the per-format mdworker_shared importers. This system reads files on your disks, extracts metadata and text, and writes the result into a local store at /.Spotlight-V100. Nothing in this path leaves your machine. There is no remote backup of the index, no telemetry on what you searched, no analytics ping when you open a result.

The second is Suggestions — Apple's umbrella term for the cluster of features that surface app suggestions, web results, news, App Store hits, dictionary lookups, Siri Knowledge, and (on supported hardware) Apple Intelligence inline answers. This system does call out to Apple's servers. Apple publishes a data-use disclosure describing what is sent and how identifiers are handled.

When you type into Spotlight on a default macOS install, both systems run in parallel and their results are interleaved. That is why a single Spotlight panel can show a file from your Desktop in the same scroll as a Bing web result and an App Store suggestion.

What stays on your Mac

The local index, in its entirety. That means:

File names, paths, modification dates, and content-type metadata for every file on every volume that has not been excluded.
Extracted text for indexable formats — .txt, .md, .pdf, .docx, source code files via the developer-tools importer, EXIF + caption text for images, mail headers when Mail is configured.
Smart predicates and saved searches.
The on-disk store.db itself, which is just a serialized inverted index.

The index is readable by the user with mdls and mdfind. It is not encrypted at rest beyond whatever FileVault gives it. Backups are not made.

What Apple's servers see

When Suggestions is enabled — and it is, by default — typed search queries are sent to Apple while you type. Apple's own Spotlight Suggestions disclosure describes the request shape:

The search query itself.
An approximate location (city or region, derived from device location services if enabled).
The device type and OS version.
A rotating short-lived identifier used for Suggestions personalization; per Apple's documentation, this identifier rotates every 15 minutes and is not tied to your Apple ID.

Apple says the identifier is reset on every device reboot and that queries are not retained longer than needed to provide the results. There is no public second-source audit of that claim; you are taking Apple's word for it. For most users, that trade-off is acceptable — for some it is not, which is what the toggles are for.

What changes when you enable Apple Intelligence

On hardware that supports it, enabling Apple Intelligence in System Settings adds a third layer. Some queries you type into Spotlight may now be routed to Apple's on-device language model (small, runs locally) or, for harder queries, to Private Cloud Compute — Apple's confidential-compute infrastructure that runs larger models on Apple silicon servers under sealed-attestation guarantees.

Apple's Apple Intelligence privacy and security guide is the canonical read for what Private Cloud Compute promises (no persistent storage of your prompt, hardware attestation of the running stack, independent researcher access to verify the same image). It is the most rigorous architecture Apple has published for a cloud inference path. It is also still a cloud inference path — your prompt leaves the device, even if the design makes it difficult for anyone to retain it.

If you want a Spotlight that does not engage any remote model on any query, Apple Intelligence must be off.

The toggles that matter

System Settings → Spotlight → Search Results controls which categories appear. Anything you uncheck will stop appearing as a result row and — for the network-sourced categories — stop generating outbound requests. The categories that involve network traffic:

Suggestions from Apple
Web Searches
Movies
Music
News
App Store

System Settings → Spotlight → Siri Suggestions is a separate toggle covering the "Siri thought you might want this" surface. Disabling it stops Spotlight from showing the predicted apps and contacts based on your routine, and stops the corresponding background telemetry.

System Settings → Apple Intelligence is where you opt into or out of the model layer entirely. There is no per-app override; if Apple Intelligence is off in Settings, Spotlight will not use it.

To remove all network traffic from Spotlight at once:

Uncheck every category under Spotlight → Search Results except Applications, Documents, System Settings, and any other local-only entries.
Turn off Spotlight → Siri Suggestions.
Turn off Apple Intelligence at the top of System Settings.

After those three changes, Spotlight is a local-only search box that consults only your on-device index.

What about the "improve Spotlight" toggle

Buried in System Settings → Privacy & Security → Analytics & Improvements there is a switch labelled "Improve Search & Spotlight" (the exact label has changed across macOS releases). When enabled, it sends Apple anonymous samples of your Spotlight queries and result clicks to improve ranking. This is independent of Suggestions — it can be off while Suggestions is on, and vice versa. The Privacy Guides macOS hardening guide recommends turning it off, and on a default install it is on.

A useful framing

Spotlight on macOS is not a privacy disaster, and it is not the friend it sometimes pretends to be either. It is two services in one UI:

The local index is one of the most respectful pieces of search infrastructure on any consumer OS. It is genuinely on your machine, queryable with documented commands, and inert when you are not typing into it.
The Suggestions and Apple Intelligence surfaces are normal cloud features wearing Apple's privacy carefully — better than most competitors, not the same as not existing.

If you want the launcher hotkey to never talk to a server, you have two paths. One is the toggle audit above — keep Spotlight, remove every network category. The other is to move the daily ⌘Space hotkey to a launcher that has no network surface to begin with. CmdSpace is one such option: zero outbound calls, a local Rust-backed index, $29 one-time. The migration guide walks through the rebind.

Whichever path you choose, the important step is the audit itself. Most users have never opened Spotlight → Search Results in their lives. Spending five minutes there is the single highest-impact privacy change you can make on a Mac in 2026.