What is mediaanalysisd on Mac?

Last updated: 2026-08-08

What it is

mediaanalysisd is a background media-analysis daemon supplied by Apple with macOS. It runs on demand to examine photos, videos, and media used by other system clients. Its analysis capabilities include faces, text, scenes, image features, and visual-search information.

Calling mediaanalysisd only a “Photos analysis process” misses part of its role. Files included with macOS show that it provides services to Photos, live-video, and HomeKit clients. Its executable is stored inside the protected MediaAnalysis private framework, and its code-signing identifier is com.apple.mediaanalysisd.

That broad role does not mean every visible media feature can be assigned solely to mediaanalysisd. Apple has not published the exact division of work between this daemon and the other components behind Live Text, Visual Look Up, Photos search, and related features. Local executable information supports OCR and visual-search work, but the complete cross-process call paths remain unverified.

Why it talks to the network

The best-documented network-related activity is Enhanced Visual Search. When that feature is enabled, the device first identifies regions that may contain landmarks and creates low-fidelity embeddings locally. These embeddings are mathematical representations, not copies of the original photos or videos.

The embeddings are encrypted and sent with dummy requests through a third-party Oblivious HTTP relay. The relay prevents Apple from directly associating the request with the originating IP address, while Apple’s service compares the protected request with a global landmark index. The matching result is returned in encrypted form. Differential-privacy protections add dummy requests, so not every transfer corresponds to a landmark found in the library.

A user-initiated Visual Look Up request can also send a limited visual-search query and related context to Apple’s search services. Apple has not confirmed that mediaanalysisd, rather than another search component, always establishes that connection. It would therefore be inaccurate to assign every Visual Look Up connection to this process.

The local executable also contains handling paths for obtaining Photos resources that are not stored locally. Analysis may trigger a download when an original exists only in iCloud, but it remains unverified whether the resulting connection will be attributed to mediaanalysisd or to cloudphotod. Apple does not publish a stable list of hostnames used by mediaanalysisd, so a specific domain should not be treated as a permanent identifier for the process.

How much traffic is normal

Apple has not published a normal byte range for mediaanalysisd, whether per request, per day, or per library. There is no reliable MB figure that can distinguish healthy activity from a problem.

Enhanced Visual Search should range from no traffic to intermittent encrypted queries and responses. That traffic would ordinarily be much smaller than transfers of original photos, iCloud video synchronization, or media streaming. A first analysis of a large library may produce more queries, and the dummy requests used for privacy also increase the total amount transferred.

Those observations are useful only as broad expectations. They are not a promised limit. Sustained high-volume traffic should not be declared normal merely because the process is named mediaanalysisd. It could involve retrieval of iCloud resources, cache updates, or failed operations that keep retrying. Apple has not published enough process-specific information to determine the cause from byte totals alone.

Background analysis after importing media or updating the system may be expected. Apple nevertheless provides no fixed completion time or traffic baseline. If the same activity continues for a long period or appears to process the same resources repeatedly, treat it as something to investigate rather than assuming that ordinary library organization explains it.

Can you turn it off

The practical recommendation is to keep mediaanalysisd enabled. Apple provides no supported System Settings switch for shutting down the entire daemon or disabling all of its network access. There is therefore no system path to list for a process-wide off switch.

Force-quitting the process is not a durable control because launchd can start it again. Removing its launch configuration, executable, databases, or caches is unsupported. Those changes may be reversed by the system and can lead to repeated analysis, broken features, or greater resource use. Blocking the daemon with a firewall can also cause analysis, search, Visual Look Up, or other clients of the service to fail, become delayed, or retry.

There is one narrower supported choice. To disable Enhanced Visual Search, open Photos > Settings > General and clear Enhanced Visual Search. The consequence is that Photos can no longer use Apple’s global index to find landmark or point-of-interest images that lack location data.

That setting controls one landmark-search feature. It does not disable mediaanalysisd, stop OCR, face, scene, or video analysis, or prove that the process will make no other network connections.

What people get wrong

• “mediaanalysisd is third-party malware or a photo-stealing program.” It is an Apple-supplied macOS process, stored in a protected system directory and identified as com.apple.mediaanalysisd. Its presence alone is not evidence of malware or data theft.

• “Enhanced Visual Search uploads entire photos to Apple.” Apple says the feature sends encrypted, low-fidelity mathematical embeddings rather than photos or videos. Requests pass through an OHTTP relay and are mixed with dummy requests.

• “All photo analysis happens in the cloud.” Apple says several Photos tasks—including analysis of faces, scenes, people and pets, and photo quality—run on the device. Enhanced Visual Search and user-initiated Visual Look Up include protected server queries, so “all local” would also be inaccurate.

• “Turning off Enhanced Visual Search completely disables mediaanalysisd.” The setting affects one landmark-search feature. mediaanalysisd can still run for text recognition, scenes, faces, video, and other system clients.

• “mediaanalysisd is the iCloud Photos upload and download process.” Its central responsibility is media analysis; cloudphotod is the main iCloud Photos synchronization daemon. Analysis of non-local resources may indirectly cause downloads, but Apple has not fully disclosed which process owns every resulting connection.

• “mediaanalysisd and photoanalysisd are the same process.” macOS includes separate launchd jobs and executables for them. Their photo-analysis responsibilities overlap, but Apple has not published their complete internal boundary.

• “Disabling Spotlight indexing will definitely stop mediaanalysisd.” There is no reliable basis for that claim. Its launch configuration also registers Photos, video, and HomeKit services and schedules independent background work.

• “Deleting its launchd file, analysis databases, or caches is a safe optimization.” Apple supports none of those actions. The files may return, and deleting them can cause reanalysis, feature failures, or increased resource consumption.

• “High CPU use or continuous network traffic must be normal library organization.” Imports and system updates may be followed by background analysis, but Apple gives no duration or traffic baseline. Repeated long-running work on the same resources should be investigated as a possible failure or retry loop.

Seeing what it actually used

When the published guidance cannot provide a byte range, the next step is to inspect mediaanalysisd by process in Bytetally and compare its uploads and downloads across the period in question. Check whether the traffic is occasional or sustained and whether it coincides with library imports, visual searches, or repeated background activity. The measurement will not reveal every internal request, but it gives you evidence specific to your Mac instead of relying on a guessed “normal” number.

Related processes

Common questions