How Apple's Private Cloud Compute Keeps Your AI Prompts Private on Google Cloud — Even From Google

When Apple announced at WWDC 2026 that its next-generation AI models would run on Google Cloud using NVIDIA GPUs, the immediate question from privacy-conscious users was obvious: does Google see my Siri queries?

The short answer is no — but the technical and contractual architecture behind that answer is worth understanding. Apple has extended its Private Cloud Compute (PCC) to third-party data centers for the first time, creating a system where even the cloud provider cannot inspect the payload.

PCC on Google Cloud: How It Works

Apple's approach is not a single pop-up privacy notice. Instead, it layers new contractual and hardware-level guarantees on top of its existing PCC architecture. At WWDC 2026, Apple announced it is running PCC workloads on Google Cloud using NVIDIA Blackwell GPUs, Intel TDX CPUs, and Google's Titan security chip .

The same PCC privacy promises — no data storage, no logging, no training on user data — now apply to Apple Intelligence requests processed on Google Cloud infrastructure . Apple's security research blog and Craig Federighi explicitly stated that "we use none of the models that Google deploys to its customers" . Apple licenses the Gemini model weights and runs them inside its own PCC environment, not on Google's shared AI infrastructure . Google is contractually prohibited from training on any data sent through Apple's PCC pipeline .

What Data Actually Leaves Your Device

Not everything you say to Siri goes to Google. Apple uses a three-tier processing strategy:

• Tier 1 — On-device (most routine requests): Simple tasks — setting alarms, controlling music, opening apps — are handled entirely by Apple's own neural models running locally on your iPhone or Mac. No data is transmitted anywhere .
• Tier 2 — Apple Private Cloud Compute (moderate complexity): Queries that need more power but fall short of the heaviest workloads go to Apple's own PCC servers on Apple silicon .
• Tier 3 — PCC on Google Cloud (heaviest queries): Only the most demanding requests — image understanding, generation, and advanced reasoning — are routed to Google Cloud .

The data that leaves the device is the query (prompt) and the minimal context needed to generate a response. Metadata like IP addresses and request logs are not retained . Apple's latest third-generation Foundation Models include three server-based models running on PCC, which the company says ensures user data is "never stored or shared with anyone, including Apple" .

Apple's Broader AI Strategy: Foundation Models and the Google Partnership

The January 2026 multi-year deal between Apple and Google places Gemini at the core of Apple's next-generation Foundation Models . Apple launched five new Foundation Models at WWDC 2026 — a mix of two on-device models and three that run on PCC . The most demanding model, AFM 3 Cloud Pro, runs on NVIDIA GPUs inside Google Cloud .

Apple chose Google Cloud as its first third-party PCC partner because of Google's confidential computing capabilities, stacking NVIDIA Confidential Computing on Blackwell GPUs, Intel TDX on CPUs, and Google's Titan chip anchoring the root of trust . Apple describes the result as "the first time these primitives have been integrated into a comprehensive, end-to-end confidential inference pipeline capable of operating at a global scale" .

This architecture allows Apple to offer state-of-the-art AI — image understanding, generation, reasoning — without abandoning its privacy-first brand . WWDC 2026 also introduced tools that let developers swap AI providers (Apple on-device, Google Gemini, Anthropic Claude) via Swift Package Manager without code changes .

Usage Limits for Third-Party AI in Apple Creator Studio

Apple Creator Studio (a $129/year subscription) includes AI features in Keynote, Pages, Numbers, Freeform, Final Cut Pro, and Pixelmator Pro . Apple's official support page states that "Some artificial intelligence features of Apple Creator Studio utilize third-party models and may have usage limits and restrictions" .

Apple does not publicly list exact per-feature caps for each third-party model. The company says users can generate at least 50 images and 50 Keynote presentations (with approximately 8–10 slides each) per month, plus presenter notes for 700 slides . However, developer and security researcher Steve Troughton-Smith reported that actual caps appeared dramatically lower in practice — a single Keynote slideshow used half of his monthly ACS limit, suggesting a limit of just two presentations .

Image and Shape Generation in Pixelmator Pro use third-party models and require an Apple Intelligence-capable device . Apple does not publish precise, per-feature usage tiers for third-party AI in Creator Studio. The advertised floor is 50 AI presentations/images per month, but some users have encountered lower effective limits .