Is Your Mac Sending Data Without Your Permission?
I set up a fresh MacBook Pro last week. Stock macOS Sequoia, no third-party apps installed yet. Before I did anything else, I checked what network connections it was making.
There were over 40 active outbound connections within the first ten minutes.
To be clear, most of them are fine. Apple services checking for updates, iCloud syncing, Spotlight indexing metadata. That is expected behavior. But some of them are worth understanding, because once you start installing third-party apps, that number explodes, and not all of it is benign.
What macOS sends on its own
Even before you open a single app, macOS is actively communicating with Apple servers. Here is what I found on a fresh install:
Apple telemetry. macOS sends diagnostic data to Apple unless you opted out during setup. Most people click through setup quickly and leave this enabled. It includes crash reports, usage patterns, and Siri data. You can disable this in System Settings, then Privacy and Security, then Analytics and Improvements.
iCloud sync. If you are signed into iCloud, your Mac continuously syncs data including Keychain passwords, Safari bookmarks, Notes, and Reminders. This is encrypted end-to-end for most categories, which is good. But it means your data is leaving your machine constantly.
Spotlight suggestions. When you type in Spotlight, your queries can be sent to Apple to provide search suggestions. You can disable this in System Settings, then Siri and Spotlight, then uncheck Siri Suggestions.
Certificate validation (OCSP). Every time you open an app, macOS checks with Apple whether the developer's certificate is still valid. This means Apple's servers receive a log of every app you open. Apple says they do not log this data, but the connection happens regardless.
What gets worse with third-party apps
This is where things get interesting. I installed 20 common Mac apps and monitored their network behavior for 24 hours.
Some findings that stood out.
One popular productivity app was connecting to six different analytics services on launch. Six. Not one crash reporter and one analytics service, which I might forgive. Six separate tracking endpoints collecting usage data.
A well-known code editor was sending my project directory names to a telemetry service. Not the code itself, but the names of the folders I was working in. That might seem harmless until you realize folder names can contain client names, project codenames, or other sensitive information.
A photo editing app was checking a licensing server every 90 seconds. Not on launch. Every 90 seconds. That is 960 network calls per day just to verify that I had paid for the software.
None of these are malware. They are all legitimate, well-known applications. But they are all sending data from your machine without making it obvious to you.
How to check your own Mac
You can check this yourself. Open Terminal and run:
nettop -m tcp
This shows you every active network connection in real time. It is noisy and hard to read, but it gives you the raw truth about what your Mac is doing on the network.
For something more readable, CoreLock's network monitor shows every connection your Mac makes, identifies the process responsible, and flags anything connecting to known tracking, analytics, or suspicious endpoints. It translates the raw connection data into plain English so you can see "Chrome is connecting to analytics.google.com" instead of an IP address.
Should you be worried?
Honestly, it depends on your threat model. If you are a journalist, activist, or someone handling sensitive data, yes, you should care deeply about which apps are phoning home and where that data goes.
If you are a regular user, the main concern is not that any single connection is dangerous. The concern is that you have no visibility into what is happening. You trusted these apps when you installed them, and most of them are quietly sending data you never consented to.
The answer is not to panic and delete everything. It is to have visibility. Know what is happening on your network. Know which apps are chatty. Make informed decisions about what you keep installed.
What you can do right now
- Disable analytics sharing. System Settings, Privacy and Security, Analytics and Improvements. Uncheck everything.
- Disable Siri Suggestions in Spotlight. System Settings, Siri and Spotlight. Uncheck the suggestions.
- Review app permissions. System Settings, Privacy and Security. Go through every category. Remove permissions from apps that should not have them.
- Check your network connections. Either use Terminal with nettop or use a tool like CoreLock that makes it readable.
- Audit your installed apps. If you have apps you have not used in months, remove them. Every installed app is a potential source of unwanted data transmission.
Your Mac is a great computer. But it is not a private one by default. That is something you have to set up yourself, and the first step is knowing what is actually happening on your network.