What tccd does
A process is a program running in the background. tccd is the one macOS uses for privacy permissions — which apps may use the microphone, the screen, or your contacts. Its log shows it answering those checks.
It lives in macOS's own system folder, and nobody installs it. Apple's manual page for tccutil describes the privacy database as the store of "decisions the user has made about whether apps may access personal data."
For most checks, the log shows tccd looking up the app and checking its code signature — the stamp that proves who made the app.
First, measure it
In this command, %CPU is an average over up to the last minute, so one reading can lag behind a spike. The steadier number is TIME, the total processor time tccd has used since it started. Take two readings a few minutes apart, while the fans are running.
% ps -axo pid,user,pcpu,time,etime,comm | grep -E 'PID|tccd$' PID USER %CPU TIME ELAPSED COMM
589 root 0.0 6:04.79 17-12:07:48 /System/Library/PrivateFrameworks/TCC.framework/Support/tccd
960 you 0.0 3:06.88 17-12:07:29 /System/Library/PrivateFrameworks/TCC.framework/Support/tccdTIME is the processor time used, in minutes and seconds. ELAPSED is how long it has run, in days-hours:minutes:seconds. There are two copies: one runs as root, the system account, and one as your account (your account name appears where this shows "you"). Both paths should read exactly as shown.
When tccd CPU is normal
Between two readings a few minutes apart, TIME grows by about a tenth of a second per minute, as it did on a quiet Mac we measured.
Apps check permissions constantly. On that Mac, one app was named in about 500 checks in an hour, and the TIME of tccd grew by about one second over eight minutes. A high count over an hour is not, on its own, a fault.
Fixif TIME grows by well under a second per minute, leave tccd alone. Look at whatever else is at the top of Activity Monitor.
Signs tccd is doing real work
As a rule of thumb, testing is worth it when TIME grows by five seconds or more per minute. Or the load starts every time you open one app or document.
TIME counts processor time, so a reading of 100% held for a minute adds about a minute of TIME. Activity Monitor can show tccd above 100%. Apple Community reports describe 300–400% as soon as one app opened, and up to 30% only while certain Pages documents were open.
On a Mac we tested, a program checked one permission about 100 times a second. For those 20 seconds, tccd used 7.6 seconds of processor time, and every check appeared in its log under the app that started the program.
Find the app in the log
Many permission checks in the tccd log name the app they are about, after the word subject. This command counts those names for the last 10 minutes. Run it while the load is happening.
% log show --last 10m --predicate 'process == "tccd" AND eventMessage BEGINSWITH "AUTHREQ_SUBJECT"' --style compact | grep -oE 'subject=[^,]+' | sort | uniq -c | sort -rn | head -5 225 subject=com.cmuxterm.app
36 subject=/System/Library/PrivateFrameworks/PhotoAnalysis.framework/Versions/A/Support/photoanalysisd
3 subject=/usr/libexec/routined
1 subject=/usr/libexec/DataDetectorsLocalSourcesThe number is how many checks named that app. Paths in /System, /usr/libexec or /usr/bin are parts of macOS. A name starting with com.apple can still be an Apple app you opened, such as Pages. Here tccd was quiet, yet a terminal app was named 225 times; in the 20-second test above, the same app was named 2,085 times. Some checks print no subject line, so an empty result is not proof.
Your lead is the name, from any maker, that matches an app you had open when the load started. A program without an app name shows as a file path. When an app starts a helper program, the log can name the app rather than the helper.
Test the app, then fix it
- Save your work in that app, then quit it. Wait a few minutes and measure
tccdagain. - If TIME now grows by less than the five-second rule of thumb, that app was likely behind the load. Reopen it with the same documents and measure: if the growth returns, that confirms it.
- If TIME still grows by five seconds or more per minute after you quit it, try the next name on the list.
- Choose Apple menu > System Settings, then click Privacy & Security. Look for the app in each list, such as Input Monitoring or Screen Recording, as Apple describes, and review its access.
Fixif quitting the app settles tccd and reopening it brings the load back, update that app or report it to its maker.
What Noah can determine on this Mac
NoahNoah can read the recent tccd log, where permission checks name the app they are about. With your approval, Noah can quit that app so you can see whether tccd settles. Save your work in it first.
On a busy Mac, Noah's log read returns a slice of the lines, not a count across the whole window, so the counting command above gives the fuller picture. Noah cannot reliably tell how much processor tccd is using, so the TIME readings stay yours.
Steps to leave for last
Quitting tccd in Activity Monitor is not a fix. The app it was checking for is still running.
Some guides tell you to run tccutil reset All. Nothing shows that it lowers the load on tccd. Apple's manual page says a reset clears the permission decisions you made, so apps ask again, and tccutil has no command to undo it.
With no app named, it clears those decisions for every app. Features that needed the access, such as screen recording or input monitoring, can stop working until you turn each one back on in Privacy & Security.