Apple Logs Every App Store Keystroke — And There's No Opt-Out, Researchers Find

On June 9, 2026, security researchers at Mysk revealed that Apple logs every tap, keystroke, and search input made inside the App Store, with detailed timing information and precise timestamps . Apple uses this data to power its new Personalized Collections feature, and critically, researchers say there is no opt-out option available — users cannot disable the tracking .

The finding sent shockwaves through the Apple community, not just for what it revealed about data collection, but for when it was revealed: just one day after Apple's flagship privacy-focused WWDC 2026 keynote.

What Mysk Discovered

Security researchers Mysk — a duo known for uncovering Apple privacy issues — demonstrated the tracking by using Apple's own App Store Click Activity data export feature . They shared records showing a search for "Tim cook" being logged step-by-step, with separate entries for each stage of the query — from "T" and "Ti" through to "Tim cook" — each accompanied by precise timestamps .

The data export revealed that Apple is capturing:

• Every individual keystroke entered into the App Store search bar
• Every tap on the screen
• Precise timing information, enabling Apple to calculate typing speed

Apple is using this data to power its Personalized Collections feature, which surfaces app recommendations in the App Store . But the lack of an opt-out mechanism means users who do want the feature cannot avoid the collection, and users who do not want it have no way to disable it .

"Now Apple is putting the extensive identifiable analytics they collect in the App Store in action. They record every tap and there's no way to turn it off. They can even calculate your typing speed." — Mysk, via MacRumors

The Timing: One Day After WWDC 2026

The disclosure landed on June 9, 2026 — the day after Apple's WWDC 2026 keynote on June 8 . During that keynote, Apple dedicated significant time to trust, safety, and privacy, positioning its new Siri AI as a privacy-conscious alternative to cloud-based services .

At WWDC 2026, Apple announced :

• Next-generation Apple Intelligence and the completely rebuilt Siri AI, which Apple described as processing data on-device or through its Private Cloud Compute infrastructure
• Stronger child safety features and expanded parental controls, with mandatory Child Accounts for users under 13
• Broader software updates across iOS 27, iPadOS 27, macOS 27, and visionOS 27, with privacy features integrated throughout

In a private press session, Apple executives Craig Federighi and Mike Rockwell elaborated on the privacy architecture of the new Siri AI, distinguishing it from cloud-based services like Gemini . Apple said its commitment to privacy is a major differentiator, ensuring that personal data processed through its AI services is protected .

The Contradiction with Apple's Privacy Marketing

The Mysk discovery creates a sharp contradiction with Apple's privacy messaging :

• On stage at WWDC: Apple presented itself as a privacy-first company, with executives describing security and privacy measures around the new Siri AI and Apple Intelligence . The company emphasized that data processed through Apple Intelligence remains private and that the system uses a "system orchestrator" to decide whether to process requests on-device or through Private Cloud Compute .
• Behind the scenes: Apple was collecting fine-grained behavioral data inside its own App Store — including individual search keystrokes, taps, and timing information — with no opt-out mechanism available .

The contrast was especially jarring because the finding surfaced roughly a day after Apple's executives used WWDC to present the company's AI approach as security- and privacy-differentiating . As one researcher noted, "Apple is putting the extensive identifiable analytics they collect in the App Store in action" — directly contradicting the privacy-first narrative .

What This Means for Users

For Apple users who take the company's privacy promises seriously, the Mysk findings are unsettling:

• No opt-out: Apple provides no toggle to disable App Store analytics collection, unlike some other analytics systems on the platform .
• First-party data collection: Unlike third-party app tracking (which Apple has aggressively restricted through App Tracking Transparency), this collection happens inside Apple's own apps .
• Granularity of data: The data captured includes individual keystrokes and timing information, which could potentially be used to infer typing speed, search behavior patterns, and more .

Apple has not yet responded publicly to the Mysk findings as of publication. The company's WWDC 2026 announcements included new privacy manifest requirements for third-party apps , but the App Store's own data collection appears to operate outside those same rules.

Bottom Line

The disclosure by Mysk is the latest in a recurring tension between Apple's privacy marketing and its actual data collection practices. While Apple positions itself as a privacy leader — especially with its new on-device AI features and child safety controls — its own App Store is collecting granular behavioral data with no opt-out. For now, the Personalized Collections feature remains on by default, and there is no known way for users to disable the underlying keystroke logging .