Skip to main content

Apple Pays Nvidia to Run Siri in Google Cloud — The Privacy Paradox You Were Not Told About

  • In late May 2026, The Information revealed what many in the AI industry had suspected: Apple has agreed to use Nvidia chips inside Google Cloud to run parts of the new, Gemini-powered Siri. The arrangement is part of a broader Apple-Google AI deal first reported in March 2026.
  • The setup is structurally bizarre. Apple — the company that has marketed privacy as its competitive moat for a decade — is now shipping user Siri queries to a third-party cloud (Google) running on a third-party AI accelerator (Nvidia). The “private cloud” promise of Apple Intelligence 1.0 (2024) was that queries never leave Apple-controlled infrastructure. The 2.0 Siri breaks that promise.
  • This is not a temporary engineering compromise. According to three former Apple engineers speaking to The Information, the Apple-Google-Nvidia architecture is the only path Apple has to ship a competitive agentic Siri in iOS 27 (autumn 2026). Below — the architecture, the legal exposure under EU AI Act and GDPR, the financial mechanics, and what it means for the 1.5 billion Apple devices that will be running this by 2027.

What was announced #

The May 2026 reports describe a three-party arrangement:

  1. Apple Siri queries (voice + text) on iPhone 15 Pro+, iPhone 16, iPhone 17, M-series iPad and Mac, are routed to Gemini 2.5 Pro running inside Google Cloud.
  2. Google Cloud is using Nvidia H200 GPUs (and H300 in some regions) for the inference, with a special Nvidia privacy-preserving confidential computing wrapper.
  3. Apple has approved the use of Nvidia’s “confidential computing” technology (CG1 silicon) which allows the workload to run encrypted in GPU memory, theoretically preventing Google from seeing the plaintext queries.

In return, Apple pays Google a per-query fee (estimated $0.002-0.005 per query) and a fixed annual license for Gemini 2.5/3.0 access ($1.2B/year, per Reuters). Nvidia earns a smaller fee for the confidential computing IP and the H200 hardware lease.

The arrangement covers all Siri queries classified by Apple as “AI-required” — currently estimated at 35% of all Siri traffic (per Apple’s own analytics, leaked via app store data). The remaining 65% (timer, alarm, call, basic Q&A) still runs on-device.

Why Apple could not do this alone #

The technical reason is straightforward: Apple’s Private Cloud Compute (PCC) cannot scale to the Siri workload. PCC was built in 2024 on Apple Silicon M2 Ultra servers, with a stated capacity of “50M concurrent users” (Apple’s own marketing). At iOS 18.4 launch, the actual Siri AI-query volume spiked to 280M concurrent users during evening hours (US East Coast). PCC queued requests, with P99 latency hitting 8.4 seconds — unacceptable for a voice assistant.

Three options were on the table in late 2025:

OptionCost (annual)Time to deployPrivacyPerformance
Build more Apple Silicon PCC$4-6B capex18-24 months✅✅
Migrate to Google Cloud + Gemini$1.2B/year3 months⚠️✅
Migrate to AWS + Anthropic Claude$0.9B/year6 months⚠️✅

Tim Cook’s “build it ourselves” instinct (cf. Apple Silicon, Apple Maps rebuild) would have meant 18-24 months. iOS 27 ships in autumn 2026. The math didn’t work. Google Cloud was the only option that could deploy in time for the iOS 27 launch.

The deeper issue: Apple’s in-house LLM (codename “Ajax”) is significantly behind Gemini 2.5 and Claude 4 in capability benchmarks. Ajax 1.0 (the model behind Apple Intelligence 1.0) scored 64% on MMLU. Gemini 2.5 Pro scores 89%. For agentic Siri — which needs to understand multi-step intent — the gap is decisive. Apple did not have a model competitive enough to ship in iOS 27.

The privacy architecture (and where it breaks) #

The Nvidia confidential computing pitch is the technical justification for calling this “private”:

  • CG1 silicon on H200/H300: Nvidia’s Confidential Computing mode encrypts GPU memory and registers. The plaintext data is only visible to the CPU host (in this case, Google’s TPU control plane). Nvidia says Google cannot read the data.
  • Apple’s attestation: Apple has a hardware attestation chain that verifies the workload is running inside a confidential VM, with no admin access from Google staff.
  • No training on user data: Apple has negotiated that Google cannot use Siri queries to train future Gemini models. The contract specifies deletion within 30 days.

In theory, this is “private cloud compute, just running on Google’s hardware.” In practice, several concerns remain:

  1. Legal jurisdiction. Google Cloud’s data centers are in the US, EU, and Asia. Under the US CLOUD Act (2018), US authorities can compel Google to provide access to data, even if stored in the EU. Nvidia confidential computing does not protect against a US court order.
  2. Supply-chain trust. Apple must trust Nvidia’s CG1 silicon has no backdoors. This is unverifiable by Apple or any third party. Nvidia is a US-headquartered company; the silicon is fabricated by TSMC in Taiwan. The trust chain has multiple single points of failure.
  3. Operator access. The Google Cloud operators (SREs) can theoretically inspect the VM images, including the Apple attestation code. Apple has audit rights but cannot observe all Google internal processes.
  4. Network metadata. Even if query content is encrypted, the metadata (source IP, timestamp, query length, response size) is visible to Google. Aggregated metadata can reveal user behavior (per the 2019 Washington Post study of smart speaker metadata).

Under EU law, this matters. The GDPR treats metadata as personal data. The AI Act (effective 2026) requires explicit consent for AI processing of personal data. The current Apple setup does not request consent — it is opt-out only (Settings → Apple Intelligence → disable).

The EU AI Act and DMA exposure #

This is where the Apple-Google-Nvidia arrangement has its biggest legal risk.

RegulationApplicabilityApple’s exposure
GDPRAll EU usersFines up to 4% of global revenue ($16B for Apple in 2025)
AI Act (Aug 2026 enforcement)High-risk AI systemsFines up to 7% of global revenue ($28B for Apple)
DMA (Digital Markets Act)Apple’s gatekeeper statusFines up to 10% of global revenue ($40B)
ePrivacy DirectiveElectronic communicationsFines per-incident, can be cumulative

Specifically:

  • AI Act Article 6: Apple Intelligence 2.0 Siri qualifies as a “limited risk” AI system (chatbot). Requires transparency (✅ Apple does this in Settings) and user right to opt out. Apple provides opt-out, but the default is opt-in. AI Act may require opt-in. Apple is in active dialogue with the European Commission (per Reuters, May 2026).
  • GDPR Article 28: Apple is a data controller, Google is a processor. Apple must have a Data Processing Agreement with Google. Apple’s standard DPA was updated in April 2026 to cover the Siri delegation. EU DPAs (CNIL, BfDI) are reviewing.
  • DMA Article 5: Apple cannot prefer its own services (Siri 1.0 on-device) over third-party (Google Gemini) if both are available. The current setup is a single Siri delegate — there is no third-party choice. This may violate DMA “self-preferencing” rules.
  • ePrivacy Article 5(3): Storing Siri query metadata (even with deletion) requires explicit consent. Apple’s current “implied consent via Apple Intelligence toggle” is contested by privacy advocates (noyb, BEUC).

The risk: a coordinated EU enforcement action could fine Apple €10-20B (combined GDPR + AI Act) and force a re-architecture of Siri in the EU. This is exactly the kind of regulatory outcome that has held Apple Intelligence back in the EU since 2024 (cf. our iOS 27 device compatibility analysis and the EU DMA Apple Intelligence saga).

The financial mechanics: who pays whom #

The Apple-Google-Nvidia arrangement is structured as a three-way flow.

Apple iPhone/Mac
     │ (Siri AI query, ~$0.003 per query)
     ▼
Google Cloud
     │ (Inference on Nvidia H200, ~$0.001 per query to Nvidia)
     ▼
Nvidia H200 GPUs
     │ (Apple attestation + Google admin)
     ▼
Response to user

Annual financials (estimated, based on supply-chain checks and Google’s cloud segment revenue):

  • Apple to Google: $1.2B base license + ~$0.4B query fees = $1.6B/year
  • Google to Nvidia: $0.2B hardware lease + $0.1B confidential computing IP = $0.3B/year
  • Net Apple cost: ~$1.6B/year
  • Net Google revenue: ~$1.3B/year (after Nvidia costs)
  • Net Nvidia revenue: ~$0.3B/year

For Apple, $1.6B/year is a rounding error on a $400B revenue base. For Google, $1.3B is significant for the cloud segment ($43B in 2025). For Nvidia, $0.3B is small, but the design win matters more than the revenue — Apple is the world’s most influential hardware brand, and its use of H200 validates Nvidia’s AI accelerator dominance.

The more important number: what does Apple save by not building its own cloud? The alternative (Apple Silicon PCC at scale) was estimated at $4-6B capex. Annualized over 5 years, that’s $0.8-1.2B/year — comparable to the Google deal. So the financial case is roughly neutral, but the time-to-market case is decisive.

What it means for Siri quality (good and bad) #

Good: agentic Siri 2.0 (iOS 27, autumn 2026) will be the best Siri ever. Gemini 2.5 Pro is a state-of-the-art model. Multi-step intent (“Siri, plan a dinner with Ania on Thursday and remind me to buy wine”) will work reliably for the first time. Latency will drop to 1.2-1.8 seconds for AI queries (vs 3.5-8.4 seconds on PCC 1.0). User satisfaction with Siri (per Apple internal NPS) is expected to rise from 32 (2024) to 65+ (2027).

Bad: Gemini has known issues with EU languages, Polish included. The Gemini 2.5 Pro model in EU data centers was tuned for English (60% of training data), German (12%), French (8%), with Polish at <2%. For Polish users, this means:

  • Lower accuracy on Polish-language queries
  • Cultural references may be US-centric
  • Some Polish-specific commands (e.g. diminitives, formal/informal “Pan/Pani”) may be misinterpreted

Apple has acknowledged this and is working on a Polish-specific fine-tune, but the fine-tune depends on Apple having access to user data — which the current Google architecture does not allow. The result: Polish users will get a worse Siri experience than English/German users in 2026-2027.

The strategic picture: Apple as Google’s AI customer #

This is the most significant strategic shift in Apple’s AI history:

  • 2011-2017: Apple built Siri in-house. The model was small, but it was Apple’s.
  • 2018-2023: Apple considered buying Siri LLM capability from OpenAI or Anthropic. Decided to build in-house (Ajax project).
  • 2024-2025: Apple shipped Apple Intelligence 1.0 using on-device + PCC. Limited capability but full control.
  • 2026: Apple ships Siri 2.0 using Google Gemini. The “AI is a feature, not a product” thesis died.
  • 2027-2028: Expect Apple to ship a hybrid: on-device Apple Intelligence for simple queries, Google Gemini for complex queries, and a “personal context layer” that stays on-device for privacy-sensitive data.

The end state: Apple becomes a major Google Cloud customer for AI. This is the same pattern Microsoft fell into with OpenAI (Microsoft is now OpenAI’s biggest customer, not its competitor). Apple is becoming a Google AI customer, not a Google AI competitor.

For Google, this is the best outcome. The Android vs. iOS war is now irrelevant. The real war is “who provides the AI to 3 billion mobile devices” — and Google just won it for the next 5 years.

For Apple, this is a humiliating concession. Tim Cook’s 2019 statement (“we believe privacy is a fundamental human right”) now has a footnote: “except when we need to ship a competitive AI product.”

Plusy i minusy (analytical angle) #

Positives

  • Apple can ship a competitive agentic Siri in 2026, not 2028. The competitive moat with iOS 27 is preserved.
  • The Nvidia confidential computing architecture is genuinely good. Privacy is meaningfully better than standard cloud AI (e.g. Alexa, Google Assistant on Pixel).
  • The financial cost ($1.6B/year) is small relative to Apple’s revenue. The deal is not a sign of financial weakness.
  • Apple retains on-device processing for 65% of Siri queries. The “private by default” promise is partially kept.

Negatives

  • Apple has lost control of its most strategic AI capability. Siri 2.0 is now a Google product with Apple branding.
  • The EU AI Act and GDPR expose Apple to €10-20B in potential fines. The legal cost may exceed the financial cost of building in-house.
  • Polish (and other non-English) users get a worse experience. Apple has no easy fix without breaking the Google architecture.
  • The CLOUD Act means US authorities can compel Google to hand over Siri queries. Apple Intelligence 1.0 (on-device + Apple-controlled PCC) did not have this risk.
  • The “Apple is privacy-first” marketing is now visibly false. Brand damage is hard to quantify but real.

What to do if you are a Polish user #

If you care about privacy in 2026:

  1. Disable Apple Intelligence (Settings → Apple Intelligence and Siri → Apple Intelligence → off). This keeps the classic on-device Siri for timer, alarm, call, but blocks AI queries from going to Google.
  2. Use Gemini or ChatGPT directly for AI queries. Both have iOS apps and don’t send data to Apple’s Siri pipeline.
  3. Wait for the iOS 27 opt-in architecture. Apple has indicated (per Reuters, May 2026) that iOS 27 will offer a per-query opt-in: “Allow Siri to use cloud AI for this request?” with a clear data-handling disclosure. This is the right design, but it’s not in iOS 26.
  4. Submit a complaint to your local DPA (UODO w Polsce). Collective complaints are the only mechanism that triggers GDPR enforcement in practice.

Sources / Linki źródłowe #