Your Mac is using data and you are not using your Mac

A Mac left alone still talks to the internet, and some of that is entirely normal. The question worth answering is whether what your Mac is doing falls inside normal — and if not, which of the dozen background services is responsible. Start with the symptom that matches yours.

The short version: idle transfers are usually iCloud reconciliation, a system update downloading in the background, or an on-demand asset fetch. Those three account for most of it. Anything sustained and unexplained after you rule them out is worth attributing to a specific process before you change any settings.

Which of these matches what you saw?

A Data is moving while I am not doing anything

The most common source by a wide margin, and the easiest to confirm or rule out.

Is iCloud reconciling? Editing a note on your phone, adding a file to iCloud Drive, or a photo library still catching up will all produce transfers on a Mac nobody is touching. Two processes carry most of this: cloudd for app data and bird for iCloud Drive files. If you recently turned on Desktop & Documents sync, a very large one-time upload is expected.
Is something downloading in the background? System updates and on-demand assets are queued through nsurlsessiond, which performs transfers on behalf of other software. A large figure there is the courier's name on someone else's package.
Is your Mac waking while asleep? Power Nap lets a sleeping Mac check mail, sync and download. If the growth happens overnight with the lid shut, check that setting first.
Still unexplained? Attribute it to a process and look the process up. The process index covers what each background daemon is, roughly how much it should be using, and whether it can be turned off.

B My monthly total is higher than it should be

A total that is wrong is a different problem from a transfer you caught in the act: you need history rather than a live reading.

Find the heaviest app over the period, not just right now — the app using bandwidth at this second is often not the one that ate the month. Which app is using bandwidth covers the built-in tools first and where they stop.
Separate upload from download. A large upload is a different story from a large download, and a backup or sync client is the usual explanation. See which app is uploading data.
Then set a ceiling so the next month cannot surprise you: set a data limit with alerts at the thresholds you choose.

C My connection got slow, not necessarily over-quota

Slowness is a bandwidth contention problem. The total may be perfectly fine while one process saturates the link.

Look for a live rate hog, not a monthly total. Mac internet suddenly slow walks through finding it.
Throttle rather than quit. A sync that finishes in four hours instead of one is still doing its job. Limit an app's bandwidth keeps it alive but out of your way.
If it is a background system transfer, the same logic applies — see nsurlsessiond, which is the usual carrier.

D I am on a hotspot or a metered connection and it drains fast

Here the goal is not diagnosis but prevention: the same background work that is harmless on home broadband is expensive on a phone's allowance.

Give the hotspot its own budget, separate from your home network: data usage per Wi-Fi network.
Decide in advance what is allowed to run when you are on it — monitoring hotspot data usage covers the practical setup.
Know which services are safe to pause. The process index groups background daemons by whether they can be turned off, throttled or should be left alone.

E I saw a process name I do not recognise

Almost always a legitimate macOS daemon with an unhelpful name. Apple splits system work across many small services, so a single feature you never think about can be four separate processes with names like bird, apsd or parsecd.

Look it up in the process index — what it is, why it uses the network, roughly how much is normal, and whether you can safely disable it.
Judge by bytes, not by connection count. Several of the busiest-looking processes on a Mac move almost no data. mDNSResponder and trustd are the two classic examples.
Verify the path if you are unsure. Malware occasionally borrows a well-known system process name, so check the binary's location in Activity Monitor rather than trusting the name alone.

What counts as normal idle traffic

It helps to know the baseline before deciding something is wrong. A Mac signed in to iCloud, left awake, with automatic updates on, will do all of the following without any input from you: hold one permanent connection open for push notifications, resolve names for whatever asks, check certificate revocation when apps launch, reconcile iCloud records against the server, and periodically ask whether a system update is available.

Added together, that routine background is small — the sort of figure that is measured in megabytes across a day, not gigabytes. The processes involved are individually documented in the process index, including what a normal volume looks like for each.

What is not routine is sustained transfer with nothing to explain it: hundreds of megabytes a day, every day, on a machine where you changed nothing. That pattern usually means a sync that is failing and retrying rather than a service behaving as designed, and the fix is generally at the app or account level rather than the network level.

Why blocking is usually the wrong first move

Once you have found the responsible process there is a strong temptation to cut it off. It is worth resisting, because most background transfers on a Mac are doing something you actually want — just at a moment that does not suit you.

Blocking a sync does not cancel the work; it strands it, often silently, and you discover months later that something never uploaded. Throttling produces the outcome you were actually after: the transfer continues, more slowly, while your foreground work gets the bandwidth. For the small number of processes that genuinely are optional, turning off the feature in System Settings is cleaner than blocking the process, because then the work is never queued in the first place.

Common questions

Is it normal for a Mac to use data when idle?

Yes, some of it. A Mac that is signed in to iCloud, has automatic updates enabled and is left awake will transfer data with no one touching it: sync reconciliation, push connection keepalives, certificate checks, on-demand asset downloads. The routine amount is small. Sustained hundreds of megabytes with nothing to explain it is not routine, and that is what this walkthrough narrows down.

Does my Mac use data while it is asleep?

It can. Power Nap lets a sleeping Mac wake periodically to check mail, sync iCloud and download updates. If your data usage grows overnight while the lid is closed, that is the first setting to check — System Settings, Battery or Energy, depending on your macOS version.

How can I tell which process is responsible?

Activity Monitor's Network tab shows bytes sent and received per process since boot, which is enough to spot a heavy one but not enough to tell when it happened or what it did yesterday. For a total that survives a reboot, and for separating upload from download over a chosen period, you need something that records history.

Should I block the process I find?

Usually not. Most background transfers on a Mac are doing something you want, just at an inconvenient time. Throttling keeps the sync or download running while giving the bandwidth back to your foreground work, which is the better answer far more often than blocking is.

Stop guessing which process it was

Per-process upload and download, live and historical, so an unexplained transfer has a name and a timestamp.

Download Free on the Mac App Store

macOS 14 Sonoma or later · 100% on-device · No account