Apple insists Gemini runs “private” on Google servers, despite the shift to cloud

Cupertino is asking users to keep trusting the lock while it changes the key. Apple confirmed that its “Siri AI” upgrade, announced this week as part of Apple’s long-delayed Siri upgrade, uses Google’s Gemini language models, and it runs on Nvidia hardware installed in Google servers. The twist is that Apple is still promising the same thing it promised before it started leaning on third-party cloud capacity: privacy protections that are intended to keep even Apple itself from being able to access users’ data.

Apple’s privacy message is not a new marketing slogan. It has been part of how Apple sells iPhone, Mac, and Apple cloud services for years, with an approach built around encryption and on-device processing. The Ars Technica reporting notes that Apple’s cloud services use encryption intended to keep other people, including Apple employees, from gaining access. And Apple has long advertised that on-device processing, like scanning images, helps keep more data from leaving your device in the first place. Now, with Apple Intelligence and larger language and reasoning models that cannot run at full capability on iPhone or Mac alone, Apple is explicitly moving some workloads into Google’s infrastructure while still trying to preserve that privacy posture.

Here is the underlying constraint driving the decision. Apple Intelligence, like most “real” AI features, runs into the limits of the hardware you have in your pocket. The kinds of language and reasoning models that can run locally on an iPhone or Mac are “relatively small,” which limits capabilities and accuracy. Apple already had a partial workaround in its Private Cloud Compute system, but the Ars piece emphasizes that it relied on Apple-controlled server hardware. In other words, Apple could expand capacity without handing off the entire trust model, at least until it hit what it would take to scale.

That scaling problem is why the Gemini-on-Google-cloud arrangement is strategically important. Ars describes that to support Siri AI the way Apple Intelligence would need, Apple would have had to commit to a huge data center buildout that Apple has so far avoided. That is the capital and time reality many AI product teams now face. You can build your own capacity, or you can rent scale from hyperscalers like Google. Either way, the privacy and security story has to survive contact with auditors, regulators, and the court of public opinion, because when AI moves off-device, the risk surface gets bigger, fast.

The specific “private” claim matters because the cloud model changes who technically can see what. Apple says some models run in Google’s cloud but, critically, without giving Google any kind of access. That distinction is the center of Apple’s argument: computation can happen on third-party hardware, but the data and the ability to inspect it should remain protected under Apple’s encryption and controls. In practice, that means Apple is trying to decouple where the model runs from who can interpret the inputs. The source frames it as a continuity of promises, suggesting Apple is aiming to maintain the same encryption intent that underpins its longstanding pitch.

There is also a broader competitive and regulatory context to why decision-makers should care. Privacy claims around AI are not just consumer trust issues anymore. They intersect with global expectations that companies explain how personal data is handled, who has access, and what safeguards exist when models touch sensitive information. Apple’s approach is shaped by years of positioning it as the company that uses encryption to keep outsiders out. As the workloads move to Nvidia hardware in Google servers, the pressure to prove that those safeguards still work becomes sharper. Boards and executive teams should pay attention because privacy promises that were easier to keep in an all-Apple infrastructure world get harder when third-party clouds enter the picture.

The Nvidia and Google details are not just trivia. Ars states that Apple confirmed its use of Nvidia hardware installed in Google servers at yesterday’s Worldwide Developers Conference, following its earlier announcement that Siri AI would use Google’s Gemini language models. That means Apple is not simply swapping models, it is changing the execution environment. The strategic question is whether Apple can keep users believing that the “private” part remains private even when the server lights are not in Apple’s own data centers. If that story holds, Apple can extend AI capabilities without losing the brand advantage it has built around privacy. If it breaks, competitors and regulators will have an opening to challenge the reliability of Apple’s encryption-centered narrative.

For other executives watching this, the second-order implication is clear: AI feature teams cannot treat compute sourcing and privacy posture as separate workstreams. Apple Intelligence has pushed Apple into a compute trade-off, and Apple is trying to solve the trust problem through encryption intent and the claim of no access for Google. Whether you are an enterprise software company, a consumer app, or a platform operator, the move to third-party infrastructure will eventually force the same question: what you outsourced, what remains under your control, and what “private” actually means when the workload runs somewhere else.