Apple is extending Private Cloud Compute, the stateless cloud tier that handles Apple Intelligence requests too heavy for the phone, beyond Apple's own data centers and onto Google Cloud. The infrastructure announced this week runs on a confidential-computing stack: NVIDIA Confidential Computing, Intel CPUs with TDX, NVIDIA GPUs, and Google's Titan security chip. Apple says it co-engineered the extension with Google and NVIDIA so that PCC's guarantees carry onto hardware Apple does not own. This is the cloud half of the same story whose model half landed at WWDC yesterday: there, Gemini taught Siri while the shipped weights stayed pure Apple; here, Google's servers host Apple's privacy-preserving compute while Apple insists the privacy survives.
The mechanism is the whole argument. PCC is built on stateless computation with no privileged runtime access, so a node processes a request and retains nothing. Apple extends three things onto the Google Cloud fleet to make that checkable: a cryptographically verifiable, append-only ledger recording every Google Cloud node admitted to the PCC fleet, dual roots of trust from independent vendors for the software-attestation components, and the same transparency commitments Apple already makes on its own silicon, published binaries and live-node access through the Apple Security Bounty. The claim is not that you should trust Apple, or Google. The claim is that confidential computing plus attestation makes the data unreadable even to the operator of the building, and that you can verify the attestation yourself.
That is the part worth sitting with, because it inverts how privacy has usually been argued. Apple's brand was built on owning the stack end to end, the silicon, the OS, the data center. Running PCC on Google Cloud trades ownership for cryptography: privacy becomes a property the math enforces rather than a property the real estate implies. Yesterday's WWDC read was that Apple's privacy story survived the Gemini deal intact. Today deepens the dependency on Google along a second axis, the datacenter as well as the model, and defends it with the same move: the guarantee is supposed to hold whether or not Apple owns the metal. The honest caveat is that it is not all live yet, the protections reach full implementation gradually across a summer preview period.
For builders the interesting thing is the template, not the Apple-Google specifics. If hardware-attested confidential computing can carry a verifiable privacy promise onto rented infrastructure, then privacy becomes portable, decoupled from who operates the servers, and any company can in principle run sensitive inference on a hyperscaler without the hyperscaler seeing the data. If the attestation has gaps, Apple has put its single strongest brand asset on a competitor's machines and told everyone to check the receipts. Either way the receipts are the product: the append-only ledger and the published binaries are what turn privacy from a promise into something a third party can audit. The first real test is whether the summer preview ships with the verification tooling intact, or whether full implementation quietly trails the announcement.