Apple announced at WWDC 2026 that Private Cloud Compute will expand to Google Cloud for the first time. The move gives Apple Intelligence more capacity for demanding AI workloads, including complex reasoning. It also raises a practical question for people who use Apple devices: how can Apple extend its privacy protections to servers another company operates?
The change does not mean Google is taking over Apple’s cloud AI service. Apple says it will keep control of the software that Apple devices approve, while Google Cloud supplies part of the computing infrastructure. The key question is whether Apple’s safeguards remain verifiable when the servers are hosted by another company.
Key Takeaways
- Apple announced the Google Cloud expansion at WWDC 2026.
- The deployment marks PCC’s first move beyond Apple’s own data centers.
- Google Cloud will support demanding Apple Intelligence workloads.
- Apple says it retains control of PCC software approval.
- Users can review recent PCC activity on supported iPhones.
How Apple Private Cloud Compute Google Cloud 2026 Works
Apple uses on-device models for many Apple Intelligence requests and turns to PCC when a task needs more computing capacity. Complex reasoning and agentic tool use can need cloud resources that a phone cannot provide alone. A trusted execution environment (TEE) is a hardware-protected area where sensitive code and data can be processed separately from the surrounding system.
PCC handles requests that exceed the capacity of on-device models, then returns a result without keeping request data after processing. Apple says the cloud system uses only the data needed for a request. The device receives the result securely, and request data is not retained after processing.
When Apple Intelligence uses a cloud model
Apple Intelligence can complete many everyday tasks on the device, which keeps those workloads local. When a request needs greater capacity, PCC can process it in the cloud. The expanded service supports tasks such as complex reasoning and agentic tool use, where an AI model can work with tools to complete a multi-step request.
Apple first designed PCC around custom Apple silicon and a hardened operating system. The Google Cloud expansion changes where some processing can happen, not which Apple requests need more computing power. Apple’s privacy explanation for Apple Intelligence describes how requests may move between device and cloud processing.
| System | Where processing happens | Example use | Named security feature |
|---|---|---|---|
| Apple on-device models | Apple device | Many Apple Intelligence tasks | On-device processing |
| Apple PCC | Cloud, including Google Cloud | Complex requests | Request data is not retained after processing |
| Google Private AI Compute | Google cloud environment | Pixel 10 Magic Cue and Recorder summaries | Titanium Intelligence Enclaves, remote attestation, and encryption |
Google’s Private AI Compute is a separate service
Google introduced Private AI Compute on November 11, 2025, as a cloud platform for Gemini models. It uses custom Tensor Processing Units and Titanium Intelligence Enclaves. Remote attestation and encryption connect devices to its hardware-secured cloud environment.
PCC on Google Cloud supports demanding Apple Intelligence work, including agentic tool use and complex reasoning.
Google’s service supports Magic Cue suggestions on Pixel 10 phones and Recorder summaries in more languages. These examples belong to Google’s own AI products, not Apple’s. Treat Private AI Compute as Google’s separate Gemini cloud platform, not as another name for PCC.
What Hardware Runs PCC on Google Cloud?
The Google Cloud PCC stack pairs NVIDIA Blackwell GPUs with Intel TDX CPUs and Google’s Titan chip. Each part has a different job, from AI inference to platform trust. Confidential computing uses hardware controls to protect data while software processes it.
The deployment combines GPU protection, CPU isolation, and a hardware root of trust. A TEE is one form of protected processing, set apart from the rest of a system. The layers matter because cloud AI must handle data while calculating a result, not only while storing it.
NVIDIA GPUs and confidential inference
NVIDIA Blackwell GPUs provide high-performance AI inference, the step where a trained model produces an answer. NVIDIA Confidential Computing protects data in use during that work. The GPU can support demanding PCC workloads while hardware controls help shield the information being processed.
NVIDIA confidential computing does not describe the whole PCC system. It covers a key part of the GPU work, while the CPU and platform trust layers handle other security needs. A NIST report on confidential computing explains how hardware protections can help keep machine identities and secret keys safe during use.
| Component | PCC role | Security contribution |
|---|---|---|
| NVIDIA Blackwell GPUs | High-performance AI inference | NVIDIA Confidential Computing protects data in use |
| Intel CPUs with TDX | CPU-side processing | Hardware-based isolation |
| Google Titan chip | Platform trust root | Hardware root of trust |
Intel TDX and Google Titan
Intel Trust Domain Extensions, or TDX, provide CPU-side hardware isolation through trusted execution environments. This helps separate protected processing from other software running on the host system. In practical terms, the CPU layer adds a boundary around sensitive work.
Google’s Titan chip supplies a hardware root of trust for the platform. A root of trust gives the system a hardware-based starting point for checks about what can be trusted. That role differs from running the AI model itself, which is the job of the GPUs.
The stack’s security depends on these layers working together, not on the GPU alone.
How Does Apple Limit Google Cloud Access to Requests?
Apple’s design aims to prevent Google Cloud operators from using privileged runtime access to inspect or redirect individual PCC requests. Runtime access means control over software while it is running. Apple frames its protections around five requirements that shape the service.
The design uses technical limits, not just rules for cloud staff, to restrict access to request data. Its five requirements guide how PCC handles requests and how the system can be checked. They apply alongside the hardware protections described above.
Five PCC requirements that shape the system
- Stateless computation
- Enforceable guarantees
- No privileged runtime access
- Non-targetability
- Verifiable transparency
Stateless computation means PCC uses personal data to fulfill a request, then does not keep it through logging or debugging after returning the response. Enforceable guarantees require key parts of the service to be constrained and analyzed. These controls aim to make privacy claims technically testable.
No privileged runtime access bars interfaces that could let site reliability staff bypass privacy protections. That limit is meant to apply during outages, too. Operators may manage the broader cloud infrastructure, but the design aims to block access to the sensitive request path.
Isolated processes, short-lived software, and keys
On PCC Google Cloud, a dedicated process parses incoming request data inside its own namespace. That boundary separates parsing from other software on the system. Shared inference software is then recycled with a short time-to-live, limiting how long one software instance remains in use.
Attested keys sit in a separate confidential VM, isolated from external inputs. Attestation checks that a system has the expected state before it receives trust or sensitive keys. These steps support the wider privacy design, but confidential computing is only one layer, not a substitute for Apple’s other controls.
Apple’s use of independent PCC security research also shows why design claims and implementation details both matter. That 2026 study examined Apple’s mobile PCC client, not the new Google Cloud deployment. Non-targetability means steering one person’s request to a compromised node should require a broad compromise of the system.
What Can Users and Researchers Verify?
Apple, not Google Cloud, decides which PCC software Apple devices will trust. That approval keeps Apple in control of the code allowed to handle requests, even when the service runs on Google infrastructure. Apple also plans ways for the public and security researchers to inspect parts of the system.
Apple says sensitive PCC components use at least two independent roots of trust from separate vendors. This gives critical software more than one basis for attestation. Apple also keeps an append-only, cryptographically verifiable ledger of Google Cloud hardware in the PCC fleet.
Apple-controlled software and hardware records
Apple devices trust only PCC software that Apple has cryptographically approved. Apple retains that control when PCC runs on Google Cloud. The hardware ledger records which Google Cloud machines belong to the service, and its append-only design makes changes traceable.
PCC servers also use Secure Enclave to protect critical encryption keys and Secure Boot to check the operating system. Trusted Execution Monitor helps ensure that only signed and verified code runs. These server protections add software and hardware checks beyond the cloud host’s basic operation.
Apple’s PCC GitHub repository includes components for independent review, including CloudAttestation-GoogleCloud, CloudBoard-GoogleCloud, and cloudassetdownloader-GoogleCloud. Public source-code inspection lets people examine published code. It does not by itself provide access to running PCC servers.
Public inspection and live research access
Apple plans to publish all PCC binaries for public inspection. Researchers can also seek live-node access in research mode through the Apple Security Bounty Program. These are separate forms of review: one examines published software, while the other can study live systems under the program.
- Apple-approved software
- Append-only hardware ledger
- Independent roots of trust for sensitive components
- Public binaries and research-mode live nodes
The checklist helps distinguish software approval, hardware records, and outside review. Each answers a different question about the service. Check the repository’s Google Cloud component names when assessing which parts of the implementation are open to inspection.
What Changes for Apple Intelligence Users and Developers?
Apple’s Google Cloud expansion adds another route for demanding Apple Intelligence requests rather than replacing Apple’s own PCC infrastructure. For users, the change brings more cloud capacity into the system. For developers, Apple offers a server model through its Foundation Models framework.
The Google Cloud deployment is in preview, and Apple said it would gradually ramp toward its full set of protections during the summer preview period. PCC is not available in every region. Apple’s rollout details name no Apple data-center city, and Google Cloud has not disclosed the regions used for this deployment.
Preview, eligibility, and user checks
On iOS 27 or later, Apple Intelligence is available on supported iPhone 15 Pro, iPhone 15 Pro Max, and iPhone 16 models or later. Language and region availability can differ, and usage limits may apply. Those conditions can affect which features appear on a particular phone.
An iPhone can generate a Private Cloud Compute report for requests from the previous 15 minutes by default or the previous seven days. The report gives users a way to review recent cloud activity. Apple’s iPhone PCC report options include the time periods available for that review.
Use the on-device model when it can handle the task, and review the PCC report when you want to check recent cloud requests.
Server-model access and the business context
The Foundation Models framework gives developers access to a PCC server model. Apps with fewer than 2 million downloads can apply. Developers pay no token costs for the model, though users face daily limits and iCloud+ can provide higher limits.
The PCC server model has a 32K context size, compared with 4K for the on-device model. It offers three reasoning levels and needs an internet connection, while the on-device model works offline. Developers can also call the server model from watchOS.
For developers comparing hosted AI tools, a Mistral API setup guide covers a different provider, with its own access and usage rules. Separately, a federal judge allowed Google to continue revenue-sharing payments for Search, Chrome, and generative AI placement or preloading. The ruling limits distribution deals to one-year terms and bars requirements that rival apps stay off devices.
Google’s payments to Apple for default search placement across Safari, Siri, and other services were estimated at $20 billion per year using a 2022 figure in antitrust court documents. That estimate is not a confirmed current payment. Apple’s PCC expansion and the court ruling concern different parts of the Apple-Google relationship.
Use the on-device model when it handles the task, and check the PCC report when you want to review recent cloud requests.
Conclusion
PCC’s expansion gives Apple Intelligence more cloud capacity without turning Google into the approver of PCC software. Apple keeps control over which software its devices trust, while Google Cloud hosts part of the service. That split is central to understanding what the expansion changes.
For users, the practical next step is simple: check whether Apple Intelligence is available on the device and in the region. Check your iPhone’s Apple Intelligence availability and use its PCC report to review recent requests.
FAQ
Is private cloud compute really private?
PCC is designed not to retain request data after processing, and Apple cryptographically approves the software its devices trust. Google Cloud hosts part of the infrastructure, so Apple is relying on safeguards across another company’s systems. The full protection set is still ramping during the preview, so the design should not be treated as a blanket promise without limits.
Is Google paying $20 billion to Apple?
The $20 billion-per-year figure is an estimate based on a 2022 figure in antitrust court documents, not a confirmed current payment. A federal judge allowed Google to continue revenue sharing for Search, Chrome, and generative AI placement or preloading. The ruling limits distribution agreements to one-year terms and bars rules that keep competing apps off devices.
How does Apple Private Cloud Compute work?
When an Apple Intelligence request needs more capacity, the device can send it to PCC for cloud processing. PCC processes the data needed for that task, then returns the result securely to the device. The system is designed not to retain request data after processing, while many other Apple Intelligence tasks stay on the device.
What is the point of a private cloud?
A private cloud lets a service use more computing power than a phone or computer can provide on its own. For Apple Intelligence, PCC can handle complex requests that exceed an on-device model’s capacity. Hardware protections and limits on data handling aim to protect information while the cloud model processes it.
Does Apple have cloud computing?
Yes, Apple runs PCC for complex Apple Intelligence requests and has expanded it to Google Cloud alongside its own infrastructure. The new deployment adds another place for some requests to be processed. Apple retains control of PCC software approval, while Google supplies part of the cloud infrastructure.
Is Apple Intelligence safe to use?
Apple Intelligence includes privacy protections, but those do not guarantee that every result will be accurate or safe in every situation. Feature availability can differ by device, language, and region, and usage limits may apply. Users should treat AI responses with care, especially when the answer affects an important decision.
Does Apple have its own data center?
Apple has run PCC on Apple-controlled infrastructure, and the Google Cloud deployment expands the system rather than replacing it. Apple’s rollout details do not name an Apple data-center city for this service. The regions used for the Google Cloud PCC deployment have also not been disclosed.
