Your Siri Transcripts Are Training Apple's AI

Introduction

South Korea's privacy regulator fined TikTok 10.306 billion won, about $7 million, for collecting what 9.45 million Korean users clicked, bought, searched for, and left in their carts through tracking tools embedded across roughly 71,000 Korean companies, then matching it to their advertising IDs and TikTok accounts to work out what they're into. The tool doing the collecting is TikTok Pixel. The Personal Information Protection Commission ruled on July 22 that the consent TikTok had for this wasn't consent, because it came bundled into the box you tick to use the app.

Now read TikTok's U.S. privacy policy, last updated July 15, 2026. It names the same tool, the same off-app activity, the same advertising identifiers and cookie matching, except here it runs opt-out, from a toggle in your Ads settings. The same decision fined Apple over Siri, and Apple's live U.S. Siri page says transcripts of your requests are collected by default and used to fine-tune its speech models. No American regulator has ordered either fix for adults.

How PIPC Got to 10.3 Billion Won

At its 14th plenary meeting on July 22, PIPC fined TikTok and two Apple affiliates a combined 10.558 billion won, after an investigation Korean media reports set off. TikTok hands three behavior-tracking tools to other businesses (TikTok Pixel, the Events SDK, and the Events API), and about 71,000 Korean companies had them running inside their own sites and apps. Through those installations TikTok collected clicks, purchases, cart-adds, searches, and downloads from 9.45 million active Korean users as of December 2025, joined it to Android and iOS advertising identifiers and its own "ttp" cookie, and tied that to member accounts to infer interests and sell ads.

The legal finding is narrower than the headline. PIPC concluded TikTok never clearly told users at signup and bundled consent for the tracking with the consent required just to use the app, making it effectively mandatory, in violation of Article 15(1) of Korea's Personal Information Protection Act. "Users were never given a real choice," a PIPC official told the Korea JoongAng Daily.

Apple Distribution International drew 252 million won, $171,801 by MLex's conversion. Until August 2019, Apple collected Siri voice recordings and the transcripts made from them to improve speech recognition and search results, with no separate consent. From October 2019 it began asking separately about the recordings, then kept using transcripts for service improvement without a valid legal basis until it fixed that mid-investigation. The number is small because the conduct fell under Korea's old Network Act, capped at 400 million won for a free service, per ChosunBiz. Apple told Cybernews it will accept the decision; TikTok said only that it is "awaiting the details of the ruling".

The obvious pushback is that Korea protects its own market, which the House Judiciary Committee argued in a July 1, 2026 report about PIPC's record fine against Coupang, an American company. PIPC applied the same statute to Coupang and TikTok, and the gap between the two fines tracks Korean revenue.

The Pixel Didn't Stop at the Border

TikTok's U.S. policy describes the mechanism in its own words: "Some of our advertisers and other partners enable us to collect similar information directly from their websites or apps by integrating our TikTok Advertiser Tools (such as TikTok Pixel)." Those partners hand over "the pages you visit, products or services you purchase, and apps you download," alongside "mobile identifiers for advertising, hashed email addresses and phone numbers, and cookie identifiers."

There's a control in your in-app Ads settings letting you "manage how your activity elsewhere online is used to serve you ads on our websites and apps." The collection runs unless you find it and switch it off, the same structure PIPC held could not produce valid consent. The policy also promises TikTok doesn't share personal information for cross-context behavioral advertising "where restricted by applicable law," which means it continues wherever the law doesn't.

TikTok's likely first answer is corporate: the U.S. policy is now run by TikTok USDS Joint Venture LLC, not the Singapore entity PIPC fined, but the Pixel and the opt-out default carried over unchanged.

"By Using Siri, You Agree"

Apple publishes two Siri privacy pages, and most coverage only deals with one. "Improve Siri and Dictation" is the opt-in, governing whether Apple stores audio of your requests and lets human graders review them. The other page, "Siri, Dictation & Privacy", describes what happens when you opt into nothing.

On that page: "Your request history, which includes transcripts and any related request data, is associated with a random, device-generated identifier." Apple "may retain and use this data for up to two years to develop and improve Siri, Dictation, Search," and, in its own example, "transcripts may be used to fine-tune Siri, Search, Voice Control, Translate, and automatic speech recognition models." No opt-in governs that; it's the default state on every iPhone.

The consent language sits at the bottom of that same page: "By using Siri, Dictation, or Siri Suggestions, you agree and consent to Apple's and its subsidiaries' and agents' transmission, collection, maintenance, processing, and use of this information." Set that against PIPC's statement of what valid consent requires: the person must clearly understand what they're agreeing to and agree freely, and consent obtained where the ability to refuse is hollowed out isn't consent. Korea's finding concerned transcripts used for model improvement; Apple's U.S. page describes the same thing, under a by-use consent sentence.

Apple's counter-argument sits on the same page: the device identifier "rotates multiple times per hour," it isn't "tied to your Apple Account or email address," and request history is "not used to build a marketing profile." That's a de-identification defense, but PIPC's ruling turned on whether Apple had a lawful basis to collect the data at all, not on identifiability, which is why the remedy was a consent choice rather than an anonymization requirement.

None of this language is new. The fine-tuning example was already on the default page in the version dated December 16, 2024 and the opt-in page dated May 13, 2025, well before PIPC ruled.

A Story That Broke in America First

PIPC's release says the Apple investigation opened because of reporting on a U.S. lawsuit over unauthorized collection of Siri voice data, without naming the case. Korean outlets identify it as Lopez v. Apple, the $95 million settlement Reuters reported in January 2025, where Judge Jeffrey S. White granted final approval in October 2025 and claimants got up to $20 per device. PIPC said publicly on January 6, 2025, days after that report, that it had begun checking whether Korean users were harmed the same way.

Lopez was about Siri's accidental activations and the contractors who graded those recordings. It never reached the deliberate pipeline that turns requests into transcripts and feeds them to speech models, so the American lawsuit that pointed Korea's regulator at Apple never touched the practice Korea fined.

Twenty State Laws and Zero Opt-Ins

No federal statute requires opt-in, unbundled consent for behavioral ad tracking of adults. Twenty states had broad consumer privacy laws in force as of April 2026, and all twenty use an opt-out model for targeted advertising.

Congress tried twice and stopped twice. The American Data Privacy and Protection Act died in the 117th Congress. Its successor, the American Privacy Rights Act, was introduced June 25, 2024, had its markup cancelled two days later after House leadership signaled a block, expired when the 118th adjourned, and nobody has reintroduced it. The FTC's commercial surveillance rulemaking opened on August 22, 2022 asking whether to write rules on this exact question, and it's still at the prerule stage.

Every U.S. government action against TikTok on data consent targets children. DOJ sued on the FTC's referral in August 2024 under COPPA, seeking up to $51,744 per violation per day, and Texas sued in October 2024 under the SCOPE Act over minors' data. Texas has aimed adult-facing privacy law at other companies, from Allstate's Arity subsidiary in January 2025 to a $1.375 billion Google settlement that October, but never at TikTok's ad tracking.

Who Benefits

TikTok keeps the mechanism, and the fine is a line item. Business of Apps estimates TikTok's 2024 revenue at roughly $23 billion, about 77% of it advertising, relayed by Music Business Worldwide; the Korean fine is around 0.03% of that. The Pixel network is what makes the ad product measurable: advertisers pay for conversions, and conversions can only be counted if TikTok sees what you did on the advertiser's site.

Apple gets training data. Its own page says transcripts fine-tune automatic speech recognition models, the layer underneath every voice feature it ships. Free, continuous, no consent step to design and no opt-in rate to worry about. Apple's insistence that it never sells Siri data is probably true and beside the point, because the asset is the model.

The third beneficiary is the U.S. government: suing one company over children's data costs far less politically than taking on the entire ad-tech industry with a federal privacy law.

Private Lawsuits Are What's Left

Americans have remedies here, just not regulators. TikTok paid $92 million in 2022 to settle a class action covering roughly 89 million U.S. users, adults included, and that case predates the Pixel mechanism PIPC ruled on. A wave of California class actions starting in 2024 went at TikTok Pixel directly under the state's pen-register statute, filed against the website operators running the tracker, and survived early motions to dismiss. Then Blalock v. EquipmentShare.com sustained a demurrer without leave to amend in January 2026, and federal dismissals followed.

Apple's live analogue is Zaluda v. Apple in Cook County, where a judge certified an Illinois biometric-privacy class on January 29, 2026 covering an estimated 2.6 to 3.9 million Siri users. That statute covers voiceprints, and PIPC fined Apple over transcripts, a legally different thing that no U.S. law puts behind an opt-in.

The Bottom Line

What Korea produced on July 22 is a document no American body has produced for either company: it names the tool and orders a fix, with a statute number attached. Starting September 11, Korea's ceiling for serious violations rises to 10% of a company's total revenue, so the next ruling of this shape carries a much bigger number.

Your Ads toggle and your Siri defaults didn't change on July 22. Two federal bills written to change them never reached a floor vote, and the FTC rule has been open since 2022. The one path still working ends in a check rather than a corrected consent screen. What I want to know is what has to happen before a regulator with jurisdiction over your data writes that document.