Since Apple uses fingerprints to download apps from the App Store, I'm wondering if they are collecting our biometric data.

If so, I want to know if they hash that data? One day, if the US government asks Apple to give all users' fingerprint data, will they give it to them? Is it possible if the data is hashed?

  • You're very welcome. Commented Dec 11, 2016 at 8:11

2 Answers 2


Short answer: No, yes, no, probably not, no.

According to Apple:

Fingerprint data is used only by the Secure Enclave to verify that your fingerprint matches the enrolled fingerprint data. The Secure Enclave is walled off from the rest of the chip and the rest of iOS. Therefore, iOS and other apps never access your fingerprint data, it's never stored on Apple servers, and it's never backed up to iCloud or anywhere else.

Your fingerprint model is locked with a key pertaining only to your device, and the data is never sent off the phone. If it were to get off the phone (from an attacker, government agency, or whatever else reason), the fingerprint is a model not your actual fingerprint.

No, Apple is not collecting biometric data and no the fingerprint model is not able to be reverse engineered.

  • without data about your biometrics how can it match your finger?
    – dandavis
    Commented Dec 10, 2016 at 9:44
  • 2
    Touch ID creates a virtual model of the fingerprint (which looks nothing like a fingerprint). When you scan your finger for authentication, Touch ID converts that fingerprint being scanned into another model. The models are then compared. If the models match, you're in. Commented Dec 10, 2016 at 9:47
  • Where did the "according to Apple" come from? Commented Dec 10, 2016 at 16:47
  • support.apple.com/en-us/HT204587 Commented Dec 10, 2016 at 19:32
  • i realize it's not representational, i just think that without some data about your finger, a model is useless...
    – dandavis
    Commented Dec 10, 2016 at 19:51

In addition to Gavin's answer, fingerprints are not "hashed". It's because hashes have a property that if the input changes even by the slightest of the bit, the resulting hash changes completely. Fingerprint sensors in phones do not capture the exact same fingerprint everytime you place your finger on it.

Instead, the fingerprints are encrypted and stored in the phone.

Also, according to Apple:

Touch ID can be trained to recognize up to five different fingers. With one finger enrolled, the chance of a random match with someone else is 1 in 50,000.

So, hopefully, even if we assume that they can retrieve the fingerprints from users' devices, they can't identify people with 100 percent surity based on the fingerprints stored.

  • 1
    i think most juries would feel as confident about 50k:1 as "100%"
    – dandavis
    Commented Dec 10, 2016 at 9:43
  • 2
    dandavis - which is the problem. 50000:1 actually is not a great number in many situations. Probably okay for your iPad, though...probably
    – Rory Alsop
    Commented Dec 10, 2016 at 11:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .