Smart Input Methods Are Uploading Your Data and Invading Your Privacy — Have You Noticed?

Younger readers may not have a clear idea of what makes an input method "smart". Long ago, input methods were mostly standard ones — Smart ABC, for instance — where the candidate order never changed no matter what you typed. Today's input methods adjust based on the context of what you type and how often you use it, so it feels like the input method understands you. Behind that, your privacy is quietly being invaded.

Younger readers may not have a clear idea of what makes an input method “smart”. Long ago, input methods were mostly standard ones — Smart ABC, for instance — where the candidate order never changed no matter what you typed. Today’s input methods adjust based on the context of what you type and how often you use it, so it feels like the input method understands you. Behind that, your privacy is quietly being invaded.

What Smart Input Methods Ask For

It’s not very obvious on Windows, but on macOS or on a phone, when you install an input method the system warns you that it’s requesting permissions, and the input method itself walks you through enabling all sorts of them — access to your clipboard, your contacts, and so on.

What Smart Input Methods Know

The input method is your keyboard, so first of all it knows everything you type: your bank card numbers, your passwords, your private messages — every single thing. Then it watches your clipboard, so it knows everything you copy. To match regional dialects it uses location services to determine where you are. And to make typing names easier it scans the contacts in your address book. Frightening when you think it through, isn’t it? Your thoughts, your behavior, your needs, what you’ve been discussing lately — it knows all of it in detail.

What Happens Behind the “Smart”

While we enjoy the convenience, what’s actually happening back there? If you’re technical, capture some network traffic and see what the input method does over the network. Yes — it uploads to their servers. Have you noticed a feature called “cloud candidate words”? Have you noticed that sometimes a 6th candidate appears a moment later with a little cloud icon beside it, and it’s quite likely the word you wanted? That’s the input method uploading what you typed, then querying its server-side dictionary for the best match.

Why I’m Writing This

I’m not advertising for any input method, so I won’t recommend one. I just want people to use them with their eyes open. Along with the convenience technology brings, you give up some privacy. What I described above is common across today’s popular input methods — including, but not limited to, Sogou, Baidu, and QQ input methods. Nearly every modern smart input method uses a cloud dictionary to improve accuracy, and while you use it, it also uploads to that dictionary and contributes to it.

So how do you choose? Pick whichever vendor you trust. On iPhone, just use the built-in one. For sensitive or confidential content, stay offline and don’t use a third-party input method.