The French public prosecutor’s office has launched an investigation into Apple’s data collection practices to train its Siri voice assistant, as reported by Politico. Notably, this probe marks a significant escalation in efforts to determine potential criminal liability for privacy violations.
France’s cybercrime agency OFAC will lead this probe based on a complaint filed by the human rights group Ligue des Droits de l’Homme (LDH). This complaint is, in turn, based on whistleblower Thomas Le Bonniec’s 2020 letter exposing Apple’s surveillance through Siri sans users’ consent.
While speaking to MediaNama, Le Bonniec referred to lessons from Europe’s handling of data protection enforcement.
“The EU is weak because it does not enforce its own legislation, and it is becoming vassalised (even more) by the US government and tech companies. So the lessons that are taught by the EU are about what not to do,” he told MediaNama.
Le Bonniec’s warning is a reminder that for India, the real test of the Digital Personal Data Protection Act (DPDPA), 2023 will be whether regulators can meaningfully enforce it against Big Tech.
The Complaint and the Whistleblower’s Revelations
The LDH complaint accuses Apple of collecting, recording, and analysing Siri conversations without the consent of users. In an interview, LDH president Nathalie Tehio emphasised how the Siri developer was recording and collecting data without users’ explicit and informed consent.
She added, “We discovered thanks to Le Bonniec, that this (Siri) assistant was being triggered randomly, without people even realising it.”
Le Bonniec, hired in 2019 by one of Apple’s subcontractors for the “Bulk Data” project, wrote in his 2020 letter how he was tasked with listening to recordings obtained from Apple devices and correcting Siri’s transcription errors.
He further revealed how the Apple voice-assistant recorded everything from names and addresses, to private arguments and conversations about “cancer, dead relatives, religion, sexuality, pornography, politics”, and so on without the user’s informed and explicit consent.
Le Bonniec also described the ‘Development data’ project, where staff linked users’ personal information with Siri’s commands. To explain, this creates extensive datasets of sensitive details that could be potentially exploited by the Cupertino-based firm.
Apple’s Privacy Narrative
Contrary to the whistleblower’s claims, the smartphone manufacturer has consistently defended itself by highlighting its efforts towards ensuring privacy. In 2018, it told the US Congress that its iPhones do not listen to users without consent and do not allow third-party apps to do so either.
Meanwhile, in January 2025, the company reiterated this position, explicitly declaring that it “has never used Siri data to build marketing profiles, never made it available for advertising, and never sold it to anyone for any purpose”.
The tech giant also explained that “Siri is designed to do as much processing as possible right on a user’s device”.
Legal fallout in the US and Europe
Yet despite these assurances, the US company has faced mounting legal challenges over Siri’s data practices. When these findings were first reported by The Guardian in 2019, it triggered a five-year class-action lawsuit in the US.
In January 2025, the tech giant agreed to pay a $95 million settlement to compensate users in the US it had snooped on without consent between 2014 and 2019.
However, these issues are not unique to Apple. Amazon is facing its own legal battle over Alexa’s recordings, with a US court allowing a class action lawsuit to proceed. Plaintiffs allege that Alexa recorded both users and non-users sans their consent: raising similar concerns about meaningful consent and passive surveillance.
Advertisements
On the other hand in Europe, the Irish Data Protection Commission (DPC), which is the responsible authority for American tech giants under EU privacy law, exhibits lack of enforcement.
In 2020, when Le Bonniec first raised his concerns publicly, the DPC’s deputy commissioner told Tech Crunch: “The DPC engaged with Apple on this issue when it first arose… and Apple has since made some changes. However, we have followed up again with Apple following the release of this public statement and await responses.”
Despite these exchanges, the DPC closed Le Bonniec’s complaint in 2022 without opening a formal investigation. Importantly, the case in France brings back into focus the issues first raised with the Irish DPC.
Speaking to Medianama, Le Bonniec called the investigation: “The beginning of the reckoning for Apple in the EU.
“The opening of a criminal investigation on their massive espionage endeavour, by recording people without their knowledge or consent, sends a clear message: fundamental rights matter, and there are organisations and people determined to uphold them.”
Why This Matters For India
The lawsuit in the US and the current French probe reflect the challenges of implementing data protection laws, especially when it concerns alleged unethical data collection by tech giants.
For India, which is yet to operationalise the DPDPA, 2023, the Siri case brings to attention the key obligations for data fiduciaries. As MediaNama has reported earlier, the draft DPDP Rules, 2025, lay out extensive compliance obligations for such fiduciaries.
The rules require companies to issue clear consent notices detailing the personal data collected, the purpose for processing it, and the procedure for withdrawing consent. The rules also emphasise an itemised list of the data collected and how it will be used.
Additionally, the draft rules require data fiduciaries to safeguard personal data with measures such as encryption, masking and detailed access logs. These fiduciaries also have to notify the Data Protection Board of any data breach within 72 hours.
The question for India, then, is not whether its data protection laws contain provisions to address concerns raised in the Siri case, but whether regulators will have the capacity and will power to enforce such provisions and take action against Big Tech outfits.
Also Read:
Support our journalism:
For You