Assistants built into the operating system rather than into an app can see what is on screen, read local files, and act across programs. That is genuinely more useful and it changes what you are agreeing to.
Why on-device matters
A system-level assistant processes everything you do. Sending that to a server is a different proposition from sending a single question, which is why manufacturers are pushing processing onto the device itself.
The constraint is capability. A model that fits in a phone is meaningfully weaker than one running in a data centre, so the architecture that emerged is hybrid: local for routine work, remote for hard requests, with the split invisible.
The important question is what determines that split and whether you can see it.
The capability that justifies it
Context. An assistant that knows what document you have open, what you were doing yesterday, and who you have been corresponding with can be useful in ways a stateless chat window cannot.
That is also the exact reason it is a privacy question. The usefulness and the exposure are the same property.
What to check
Whether processing is local or remote, and whether that is disclosed per request rather than in a policy document. Whether interactions are retained and for how long. Whether your data trains future models, and whether opting out is possible without disabling the feature.
The pattern to expect
These features arrive on by default, because adoption metrics matter more than caution. The settings to limit them exist and are not prominent.
Spending ten minutes in those settings when a system update lands is the whole of the practical advice. Not refusing the technology – just knowing what it is doing.