Apple’s Yosemite OS shares Spotlight search terms by default

Apple is being called out for how it shares desktop and Web searches in its latest desktop operating system, Yosemite.

Spotlight, which underwent a rework for Yosemite, indexes desktop files and makes them searchable via keywords. By default, the latest iteration of Spotlight sends those search terms to Apple, in conjunction with Microsoft’s Bing search engine, which Apple says is used to improve Spotlight’s accuracy.

If “Location Services” are turned on in Yosemite, a computer’s approximate location is also sent to Apple whenever Spotlight is used. Apple advises users of the data it is collecting and says that the sharing can be disabled by turning off “Spotlight Suggestions.”

“Location Services” can also be turned off, but Apple still uses a computer’s IP address to discover an approximate location. Apple does not, however, collect the search results that Spotlight generates.

The worry is that users may not completely understand what is being shared, as concerns grow over how companies collect, store and use what could be sensitive or revealing data.

The issue came up after research done with Yosemite by Landon Fuller, a software engineer and CEO of New York-based Plausible Labs. He launched a website called Fix Macosx, which highlights his work using a software tool called Net-Monitor. NetMonitor studies what network connections are made by Yosemite.

Fuller found other instances in which Yosemite shared data. If someone selects “About this Mac,” which shows information about the computer, Yosemite contacts Apple, assigning a unique analytics identifier in the request, according to Fuller’s GitHub page. The contact is made even if an option to share such analytics data has been disabled.

In another example, Fuller found that search terms entered in Safari are shared with Apple, even if a person is using a search engine such as the privacy-focused DuckDuckGo and “Spotlight Suggestions” is disabled.

Also, if someone sets up Apple’s Mail application with a new email address, the domain of that address is sent to Apple, Fuller wrote.

“Mac OS X has always respected user privacy by default, and Mac OS X Yosemite should too,” he wrote on Fix Macosx.

For those who don’t want the information shared, Fuller recommends they disable “Spotlight Suggestions,” “Bookmarks & History” and “Bing Web Searches” under the “Search Results” tab in Spotlight’s preferences. To disable search terms entered in Safari, another selection — also called “Spotlight Suggestions” — should be disabled. Fuller has written a Python script that can accomplish those tasks.

Apple officials couldn’t immediately be reached for comment.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk