Behind iOS’s “unclear ledger” lies a transparency problem involving user privacy and evidence tracing.

Mr M is a long-time user of Apple Inc., the well-known American consumer electronics brand. Although the iPhone 4 in his possession has long disappeared from the market, he still takes it out from time to time to “give it a charge” — partly because of its Home button, and partly because of the finger memory left by every single press.

Today, Mr M received a message from an iPhone app designer and developer. The developer said that when checking iOS data usage under “Settings — Cellular/Mobile Data”, they noticed an unsettling category: “Uninstalled Apps” — 520.2 MB.

Here comes the question: if an app has clearly been deleted, why does it still appear to have consumed mobile data? Was it not removed properly? Are some apps still “haunting” the background? Could there even be a risk of privacy leakage?

This is not a beginner’s question. Quite the opposite. It cuts straight to the point, sharp and unsparing, pointing directly at one of the least examined grey areas in smartphone system design: users can see the number, but they cannot see the responsible party behind that number. — GPT comment

Apple’s official support information states that users can check how much cellular data each app has used in iPhone settings. Users can also view data usage by system services and reset statistics at the bottom of the page. Apple also notes that for the most accurate data usage information for the current billing period, users should contact their carrier.

In other words, the data usage list on an iPhone is essentially a front-end digital list with a “small gap in an otherwise tight system”. It does not come directly from the telecom carrier. Nor is it a forensic-grade report. Yet the hidden risks are significant — especially when one considers Apple’s vast global user base, which is estimated to be in the billions.

1. “Uninstalled Apps” usually does not mean the apps are still secretly running

In ordinary circumstances, the data shown under “Uninstalled Apps” is mostly historical data.

For example, an app may have used 800 MB before it was deleted. After the user removes the app, the system can no longer attach that 800 MB to the original app name. So the usage is moved into the broader category of “Uninstalled Apps”.

This is similar to “archiving a historical account” in bookkeeping.

The problem is that this category is too vague.

It does not tell the user which app used how much data. It does not say when that data was used. It does not show whether the traffic was generated by active user behaviour or by background activity. If scam links, malicious redirects or abnormal network connections are involved, can this record still be traced back?

That is the real issue.

Apple makes the total number balance. But it does not give users the detailed ledger.

2. This is not “privacy panic”; it is a lack of transparency

Objectively speaking, after an ordinary app is deleted, it usually does not retain the ability to run independently or connect to the internet. iOS permission controls, sandboxing and system signing are indeed stricter than many more open systems.

But the one word technology companies should be most careful with is “absolute”.

Whenever users hear phrases such as “absolutely safe”, “completely deleted” or “no risk at all”, they should remain alert. In cybersecurity, mature wording is rarely “this will never happen”. A more responsible statement is: “under normal conditions, the risk is low; under abnormal conditions, higher-level forensic analysis may be required”.

That is not nitpicking. That is professional discipline.

If the matter involves ordinary historical app traffic, the “Uninstalled Apps” category is understandable.

But if the case involves system vulnerabilities, malicious configuration profiles, spyware, phishing SMS links, fake banking pages or abnormal traffic generated by grey-market SDKs, then relying only on the iPhone’s front-end data list is clearly not enough.

3. “Reset Statistics” may make things cleaner, but it is not suitable for every situation

Apple allows users to reset cellular/mobile data statistics. For ordinary users, this is useful: at the beginning of each monthly billing cycle, they can clear the counter and make it easier to compare iPhone usage with the carrier’s bill. Apple also states that this reset option is located at the bottom of the cellular/mobile data settings page.

But if a user already suspects they have encountered fraud, abnormal charges, malicious links or account compromise, the first step should not be rushing to reset the statistics.

A more careful approach would be:

Take screenshots first, preserving the time, date, carrier name and abnormal data usage item.

Then contact the carrier to request data usage records.

At the same time, contact the bank to freeze or block risky transactions.

If necessary, report the matter to police or a cybercrime reporting body.

Resetting the statistics on the phone may not delete carrier-side, bank-side or server-side logs. But it does remove the most visible layer of evidence available to the user.

For ordinary people — especially older users and teenagers — that visible clue can be very important.

4. The real problem: users do not have an auditable ledger

The current design is an engineering compromise.

Apple may not want deleted app names to keep appearing in the list, because that could make users think the apps were not properly removed. At the same time, Apple still needs the total data figure to add up. So the system creates an intermediate category called “Uninstalled Apps”.

This is understandable. But it is not ideal.

A more responsible design should offer a clearer audit mode. For example:

In standard mode, the system could simply show “Uninstalled Apps”.

In advanced mode, users could choose to retain encrypted traffic details for the past 30 or 90 days.

In disputed cases, users could export a local data usage summary for comparison by carriers, banks or law enforcement agencies.

The system should clearly state that this data is a local device statistic, not a carrier bill or a forensic report.

This would avoid unnecessary panic while preserving traceability.

Today’s smartphone is no longer just a communication device. It is a wallet, an ID holder, a key, a photo album, a workstation and an entry point into family safety. Since it carries so many social functions, it should not be allowed to turn key evidence into an unclear account simply in the name of “user experience”.

5. Practical advice for users

If you are only checking data usage in daily life, there is usually no need to panic when you see “Uninstalled Apps”. In most cases, it is more like a historical record. It does not mean the deleted app is still continuously using data.

If you want your bill to be clearer, you can go to “Settings — Cellular/Mobile Data” at the start of each carrier billing cycle, scroll to the bottom and tap “Reset Statistics”.

But if you already suspect fraud or abnormal network activity, do not reset it immediately. Take screenshots first, preserve the evidence, then contact your carrier, your bank and relevant investigative authorities.

Technology giants cannot ask users to trust the system while giving them only a vague label.

The phrase “Uninstalled Apps” looks like a small category buried in a settings page. But behind it lies a much larger question: in an age where AI, mobile payments and telecom fraud are deeply intertwined, how much understandable, verifiable and traceable truth are platforms willing to give ordinary users?

That is the real question this article is asking.