What is webprivacyd on Mac?

Last updated: 2026-07-31

What it is

webprivacyd is Apple’s built-in WebPrivacy Daemon. It runs as an on-demand, user-level LaunchAgent and is registered under com.apple.webprivacyd. Its executable is part of Apple’s protected WebPrivacy framework, so finding it in a process list or network monitor does not mean that a third-party application installed it.

Apple’s documentation describes a narrow background job: webprivacyd periodically updates list data needed for web tracking protection. The locally verifiable list types are tracking domains and tracking subnets. These lists give participating system components current data for recognizing known tracking infrastructure.

webprivacyd is not a browser rendering process. It is also not a VPN, a general-purpose traffic proxy, or a replacement name for iCloud Private Relay. Its verified responsibility is maintaining tracking-protection list data in the background.

Why it talks to the network

A connection is expected when a web-privacy client in the system asks for an update and the locally stored lists need to be refreshed. At that point, webprivacyd contacts Apple’s Web Privacy Service. The default endpoint found in the local component is https://wps.apple.com/v1/getRemoteList.

An update request includes metadata such as the requesting client and the versions of the lists already present on the Mac. The service can return either a full list or a differential update. The verified list categories are tracking domains and tracking subnets; a differential response can avoid replacing an entire list when only changes are needed.

The precise schedule is not public. Response state, including a value such as nextUpdateDuration, can influence when another update is due, but Apple has not published a fixed interval. Apple also has not documented every system client that may trigger webprivacyd, or every regional or CDN hostname that might be involved. Those details remain unverified and should not be inferred from a single observed connection.

How much traffic is normal

Apple has not published a reliable byte or megabyte range for webprivacyd. There is therefore no supported universal figure for one update, one day, or one month, and a precise allowance would be guesswork.

The known traffic pattern is more useful than an invented number. webprivacyd may transfer nothing while idle, then produce a short burst when its lists are refreshed. It supports potentially smaller differential updates as well as potentially larger full-list updates. That makes variation between refreshes plausible, but the actual size of either kind of response has not been verified.

This is not designed to behave like video playback or a large file download with sustained traffic over time. Even so, “not continuous” does not establish a particular monthly total. The amount seen on one Mac can depend on when refreshes occur and whether the service supplies a differential or full update. Actual per-update and monthly usage remain unverified.

Can you turn it off

The practical recommendation is to keep webprivacyd available. Apple explicitly states that it has no user-configurable options, and Apple does not provide a dedicated System Settings switch for this daemon.

Safari privacy settings can control some browser-protection behavior, but they are not documented as an independent on/off control for webprivacyd. In particular, changing Prevent Cross-Site Tracking should not be presented as a proven way to stop the daemon completely.

Force-quitting the process is not a lasting control because launchd starts it on demand, and a system client may request it again. Blocking its network access or disabling it through unsupported methods can prevent timely list refreshes. Over time, the tracking-domain and tracking-subnet data may become stale, which can reduce the system’s ability to recognize and block known tracking infrastructure. There is no evidence that disabling it produces a meaningful bandwidth saving that would justify that tradeoff.

What people get wrong

• “webprivacyd is adware, malware, or a third-party monitoring tool.” It is an Apple-signed system component stored in a protected Apple framework and registered as the com.apple.webprivacyd LaunchAgent. Its presence alone is not evidence of an unwanted installation.

• “It uploads my complete browsing history or the contents of web pages.” There is no reliable evidence for that claim. The verified manual page and local protocol strings point to list updates, with fields centered on clients and list versions. However, the protocol is private and not fully documented, so it would also be too strong to claim that every system release can never send any other update metadata.

• “It is iCloud Private Relay, a VPN, or Safari’s web-traffic proxy.” These are different functions. Private Relay is a separate, two-relay browsing privacy service. The verified role of webprivacyd is maintaining tracking-protection lists, not carrying ordinary page traffic as a relay.

• “Turning off Prevent Cross-Site Tracking in Safari completely disables webprivacyd.” That has not been verified. The Safari option changes corresponding browser protections, but Apple has not documented a one-to-one switch for this daemon.

• “Ending it will save a significant amount of bandwidth.” No published traffic range supports that conclusion. The process runs on demand and can be relaunched by system clients. Unsupported blocking exchanges current tracking-protection data for lists that may become stale, without a verified bandwidth benefit.

Seeing what it actually used

If you need an answer for your own Mac, check webprivacyd in Bytetally’s per-process traffic statistics and compare its transfers across the relevant time range. Look for short refresh bursts rather than assuming that a process being present means it is continuously transferring data. Your measurement can establish what this Mac used, but it does not create a universal normal range for every Mac.

Related processes

Common questions