Where macOS privacy is heading next
Three structural shifts are already underway, and two of them make independent auditing harder rather than easier.
Forecasting product roadmaps is a waste of everyone's time. Forecasting structural direction is not, because the direction has been consistent for a decade and the constraints are visible.
Three shifts are already underway. Two of them are good for privacy and awkward for the people who like to verify things themselves.
1. Processing moves onto the device
The clear direction of travel: do the computation locally, send less. This is genuinely good. Data that never leaves cannot be leaked, subpoenaed or repurposed.
The complication is that "on-device" has become a marketing term applied to architectures that are partly remote. A feature can process locally in the common case and fall back to a server for harder work, and from the outside those two paths are indistinguishable — unless you are watching the connections.
This is the single strongest argument for keeping outbound monitoring in place even as platforms get more private: claims about locality are verifiable, and verification requires looking.
2. The platform keeps closing
Kernel extensions are gone. System Integrity Protection covers more each release. Filtering, VPN and endpoint security all run through sanctioned frameworks with defined limits.
The security benefit is real — an entire class of catastrophic third-party bug simply stopped existing. The cost is that the ceiling for third-party tools is now set by Apple's API surface. If a capability is not exposed, no amount of developer ingenuity will produce it, and a tool that works today can lose a feature in an autumn release.
Treat every third-party security tool as dependent on an API that Apple controls. Prefer tools with a track record of surviving macOS transitions, and expect a rough month after each major release.
3. Encrypted transport becomes the default
Encrypted DNS, encrypted client hello, private relay, and increasingly opaque connection metadata. Good for users against network observers. Awkward for anyone trying to audit a machine, because the signals a monitoring tool relies on get thinner each year.
The likely end state is that you will be able to see that a process connected and roughly where, but progressively less about what kind of connection it was. Attribution to a process survives; everything downstream of that gets fuzzier.
What is not going to change
- Apple will not ship a per-app outbound prompt. It generates unanswerable questions and support load. The third-party gap stays open.
- Third-party apps will keep phoning home. No platform control addresses an app talking to its own vendor about its own usage.
- Permissions will keep multiplying. Each release adds categories. The auditing burden grows, and nobody is building the tooling to manage it.
What to do about it
The strategy that survives all three shifts is unglamorous:
- Keep a baseline. Know what your machine normally does, so that changes are visible even as detail degrades.
- Prefer software you can inspect. Open source matters more as platform opacity increases, because it is one of the few remaining ways to verify a claim. Our guide to vetting free Mac utilities covers how.
- Audit permissions on a schedule. Quarterly, ten minutes. The list only grows.
- Do not confuse encryption with privacy. A perfectly encrypted connection to an advertising vendor is still a connection to an advertising vendor.
The uncomfortable summary is that the platform is getting more private and less auditable at the same time, and those are not the same axis. If you care about the second one, the habits above are what you have.
Frequently asked questions
Is on-device processing actually private?
Usually, but many features process locally in the common case and fall back to servers for harder work. Monitoring outbound connections is how you verify which path was taken.
Why did Apple remove kernel extensions?
Third-party kernel code had enormous privilege and could destabilise or compromise the whole system. Filtering now runs through sandboxed frameworks with defined limits.
Does encrypted DNS make network monitoring useless?
No, but it reduces detail. You still get process attribution and destination, with less insight into the nature of the connection.
Will Apple ever add a built-in outbound firewall?
Unlikely in a user-facing form. Per-application connection prompts generate questions most users cannot answer and significant support burden.