Why Is My Mac Using So Much Data?

In most cases the traffic comes from one of five places. Software Update downloading a macOS release or security update in the background, which for a full update is typically in the 3 to 6 GB range and for a major upgrade can be considerably more. iCloud Photos and iCloud Drive syncing a batch of new photos, videos, or files, where a few minutes of 4K video from your iPhone alone can be several hundred megabytes. App Store automatic updates, where a handful of large apps easily adds up to a gigabyte or two. Third-party sync clients such as Dropbox, Google Drive, or OneDrive re-uploading or re-indexing a folder. And video in a browser tab, including autoplaying feeds and background tabs you forgot were open, where streaming at 1080p typically runs somewhere around 1.5 to 3 GB per hour.

If you were tethered and the number was very large, the two most likely candidates by a wide margin are Software Update and iCloud sync. Both are designed to run silently, both prefer to work when the machine is idle and plugged in, and neither has any concept of an expensive connection unless you tell macOS explicitly that the connection is metered.

The reason this is so hard to catch in the moment is that none of these processes announce themselves. macOS shows a progress indicator for a foreground download in Safari, but nothing comparable for a background sync daemon. By the time you notice the carrier warning text message, the transfer is already over, and there is no built-in log you can go back and read.

The rest of this article works through the full list of culprits in more detail, then covers how to observe traffic per process while it is happening, and finally how to put limits in place so that a background service physically cannot spend more than you allow it to.

Software Update. This is the heavyweight. macOS pre-downloads updates in the background so that installation is fast when you eventually accept it, and by default this happens whenever a network is available. A point release is often a few gigabytes; a major version upgrade is larger still. You can turn the automatic download off in System Settings under General, then Software Update, by opening the small info button next to Automatic Updates and disabling the option to download new updates when available. Keeping security responses on and turning bulk downloads off is a reasonable middle ground.

iCloud Photos and iCloud Drive. If you take video on your iPhone, iCloud Photos will attempt to bring the originals or optimized versions down to your Mac, and it does not care that you are on a hotspot. iCloud Drive behaves the same way with documents. Both are worth pausing before you tether. The photo library sync is especially prone to sudden bursts, because a single afternoon of recording can queue several gigabytes of upload and download work that runs the next time the Mac sees a network.

App Store automatic updates. Modern Mac apps are not small. Electron-based apps frequently ship 150 to 300 MB per update, professional creative tools run to a gigabyte or more, and the App Store will happily fetch all pending updates at once. Automatic downloads can be disabled in the App Store settings.

Sync clients: Dropbox, Google Drive, OneDrive, Box. These are usually well behaved until something changes on the other end. A shared folder gets reorganised, a colleague uploads a video, or the client decides to re-verify its local cache, and suddenly it is moving gigabytes. Most of these clients have a pause option and a bandwidth setting, but they will not pause themselves just because you switched networks.

Time Machine to a network destination. If your backup target is a NAS or a network share rather than a directly attached drive, Time Machine will try to run its hourly backup over whatever connection exists. On a hotspot this is a very expensive habit. Time Machine will not use a connection macOS has marked as low data mode, but it has no idea about your carrier plan otherwise.

Everything else that adds up quietly. Mail fetching messages with large attachments, especially with multiple accounts configured to download full messages. Spotlight and Siri suggestions making small but constant lookups. Messages downloading photos and videos sent to group threads. Developer tooling, which deserves its own mention: a single Docker image pull is commonly several hundred megabytes, Xcode simulator runtimes are multiple gigabytes each, and installing dependencies for a fresh project can be surprisingly heavy. Backup services such as Backblaze or Arq will also run continuously unless explicitly paused.

macOS ships with one tool for this, and it is worth knowing both what it does and where it stops. Open Activity Monitor from Applications, then Utilities, and select the Network tab. You will see a list of processes with columns for bytes sent, bytes received, packets sent, and packets received. Click the header of the Rcvd Bytes column to sort descending, and the process that has been consuming the most will rise to the top.

This is genuinely useful for catching something in the act. If your Mac is busy right now and you want to know why, sort by received bytes and watch for a few seconds. A sync daemon or an update process will be obvious. The Data Received column at the bottom of the window also shows a running total.

The limitation is that these counters reset when the process restarts and when you reboot, and Activity Monitor keeps no history whatsoever. If your data disappeared yesterday, or overnight, or while the lid was closed, there is nothing to go back and read. You cannot ask it what happened between 2 and 4 in the morning. It also shows only process names, not destinations, so you can see that a process moved 4 GB but not where any of it went.

A few other things it will not do. It does not distinguish between Wi-Fi and your hotspot, so traffic on a cheap home network and traffic on an expensive tethered connection are counted together in the same number. It does not warn you when a process crosses a threshold. And it cannot stop anything, only report. The only lever it offers is force-quitting a process, which is a blunt instrument if that process is something you actually want running most of the time.

For a one-off diagnosis while the problem is happening, Activity Monitor is the right first stop and often all you need. For understanding a pattern over days, or for finding out what happened after the fact, you need something that records history and attributes it per app. This is the gap that dedicated monitoring tools fill: NetMute keeps a per-app traffic history along with domain-level logging, so you can look back at a specific window of time and see both which app was active and which destinations it was talking to. TripMode is the other well-known Mac tool in this space and takes a different approach, focusing on blocking apps outright while you are tethered.

macOS has one built-in mechanism worth using first. When you are connected to your iPhone hotspot, open System Settings, go to Wi-Fi, click Details next to the network, and enable Low Data Mode. This tells the system the connection is expensive, and a number of Apple services respect it: automatic updates are deferred, iCloud sync is throttled or paused, Photos stops syncing in the background, and Time Machine will not back up over that network. It is genuinely effective for the Apple side of the problem.

The catch is that Low Data Mode is a per-network setting you have to remember to turn on, it does not apply to a new hotspot you have not connected to before, and third-party apps are under no obligation to honour it. Dropbox, Docker, Backblaze, and your browser will carry on exactly as before. It is a good first line of defence, not a complete one.

Beyond that, the manual work is worth doing once: disable automatic download in Software Update, turn off automatic app updates in App Store settings, set Mail to fetch manually or on a long interval when travelling, and pause your sync clients before you tether. If you back up over the network, exclude that destination or disable backups on the road. None of this is complicated, but all of it depends on you remembering to do it before the data is gone rather than after.

The structural problem is that these are all opt-out settings applied one app at a time, and there is no single place in macOS where you can say "this app gets 500 MB this month and then it stops." That is the difference between reducing your exposure and actually bounding it.

The reliable fix is a limit that enforces itself. NetMute is a per-app firewall and traffic monitor for macOS built around this idea: you set a daily or monthly cap on an individual app, or a global cap for the whole Mac, and it enforces it. You get a notification when the app crosses a threshold you choose, such as 80 percent, and the app is blocked automatically at 100 percent. If Dropbox has a 1 GB monthly allowance on your tethered profile, it cannot exceed it regardless of what changed in a shared folder.

The part that matters most for hotspot users is that limits can differ by network. NetMute uses network profiles that switch automatically based on the Wi-Fi SSID you are connected to, so your home network can be wide open while your phone's hotspot runs a strict profile with tight per-app caps. There is also hotspot protection that applies a strict profile automatically when you join an unknown network, which covers hotel and airport Wi-Fi where you have no idea what the connection actually costs or how reliable it is. Captive portals are handled, so the hotel login page still loads and works normally.

Alongside the limits there is a real-time monitor showing what each app is moving right now, a history you can look back at, domain-level logging so you can see where traffic is actually going, and one-click blocking with temporary rules that expire on their own so you do not accumulate a pile of forgotten firewall entries. Tracker Shield blocks a list of over 1,100 known tracker domains, which is a modest but non-zero saving on top of everything else.

NetMute is free to download on the Mac App Store, and Premium is a single in-app purchase rather than a subscription. Whether you use it or not, the underlying principle is the one worth taking away: on a metered connection, the only reliable protection is a ceiling that enforces itself, because every background service on your Mac was designed on the assumption that bandwidth is free.