Apple Ends End-to-End Encryption for Publicly Shared iCloud Files

Apple is introducing a new content-checking policy for photos and files shared through publicly accessible iCloud links. Starting with iOS 27.3 and corresponding updates to iPadOS, macOS and visionOS, the company will make content shared using the “Anyone with the Link” option accessible to Apple so it can check for harmful material. The change has raised privacy concerns because it reinforces an important limitation of Apple’s cloud security protections.

However, there is an important distinction: Apple is not removing end-to-end encryption from all iCloud files or disabling its Advanced Data Protection feature. Publicly shared links already did not support end-to-end encryption, even when Advanced Data Protection was enabled. The new development is Apple’s decision to introduce explicit checks for harmful content shared through these links.

What Is Changing in Apple’s iCloud Sharing Policy?

Apple outlined the change in a support document published on November 3, 2026. The policy applies to content shared through the “Anyone with the Link” setting on supported versions of its operating systems.

When users share photos or files stored in iCloud, they can generally choose between sending a copy and sharing a link. Link sharing offers two access options:

• People you choose: Only individuals invited or approved by the person sharing the content can access it.
• Anyone with the Link: Anyone who obtains the link can access the shared item without being individually invited.

Apple says content shared through the second option becomes accessible to the company for harmful-content checks.

The policy specifically identifies photos stored in iCloud Photos and files stored in iCloud Drive. It does not mean Apple will begin scanning every photograph, document or other file stored privately in an individual’s iCloud account.

The distinction is important because the new checks are tied to publicly accessible sharing links, not ordinary private cloud storage.

Why Public iCloud Links Are Not End-to-End Encrypted

End-to-end encryption is a security method in which information is encrypted on the sender’s device and can only be decrypted by authorized recipients. The service provider hosting the data cannot independently read its contents.

Apple offers Advanced Data Protection (ADP), an optional feature that extends end-to-end encryption to additional categories of iCloud information. It is designed to give users greater control over access to their stored data.

However, certain sharing features do not support this protection.

When a user selects “Anyone with the Link,” the content must be accessible to people who possess the link, including people who are not individually authenticated or approved. Apple explains that, to facilitate this type of sharing, the item is no longer end-to-end encrypted.

This limitation applies even when the owner and participants have enabled Advanced Data Protection.

Consequently, the November policy does not represent a newly announced removal of encryption from previously protected private files. Instead, Apple is explicitly introducing content checks for material shared through a method that already falls outside end-to-end encryption.

What Content Will Apple Check?

Apple says it will check items shared through “Anyone with the Link” for harmful content.

The company has not provided a detailed public definition of everything that qualifies as harmful. This lack of specificity has become one of the main concerns surrounding the announcement.

The policy comes amid continued pressure on technology companies to address the distribution of child sexual abuse material and other illegal content through online services.

However, it would be inaccurate to assume that Apple’s announcement establishes a comprehensive list of content categories or explains precisely how every check will be conducted.

Apple’s support document focuses on the ability to examine publicly shared items and the actions the company may take if content is identified as harmful.

The policy also does not establish that Apple will routinely inspect all private iCloud photographs, personal documents or files shared exclusively with selected recipients.

Apple Can Delete Content and Restrict Accounts

The updated support documentation gives Apple broad enforcement powers when it identifies harmful content.

The company says it reserves the right to move, refuse, modify, remove or delete material that violates its policies.

Potential account-level consequences include:

• Blocking or disabling an Apple Account.
• Preventing the creation of a new Apple Account using the associated email address or phone number.
• Taking additional action against accounts connected to harmful material.
• Involving law enforcement when necessary.

These provisions indicate that the policy is not limited to checking shared files. Apple also reserves the ability to take action against accounts associated with content it considers harmful.

The company has not publicly specified a detailed enforcement process, including how users can challenge individual decisions or how flagged material will be reviewed in every situation.

That leaves questions about transparency, false positives and the appeals process that may become more important as the policy is implemented.

When Will the New iCloud Checks Begin?

The changes are scheduled to arrive with version 27.3 of Apple’s operating systems.

The first developer beta versions of iOS 27.3, iPadOS 27.3, macOS 27.3 and visionOS 27.3 became available in November 2026. A broader public release is expected in December, although the final rollout schedule could change.

The policy is therefore associated with the upcoming software updates rather than an immediate change affecting every Apple device on November 5.

Apple’s support document also does not clearly establish whether links created before the update will all be treated in exactly the same way once the new software versions become available.

Users who regularly share iCloud content through public links should review their existing sharing arrangements and avoid leaving unnecessary links active.

What Apple Users Should Do to Protect Their Privacy

The announcement highlights the importance of choosing the right sharing permission before sending sensitive information.

For personal photographs, confidential documents and private files, users should consider selecting “People you choose” rather than “Anyone with the Link.”

The restricted option provides access to invited or approved recipients instead of making the content available to anyone who obtains the URL.

Users should also review links they have previously created, particularly those shared for temporary purposes. Old links may remain accessible longer than expected if they have not been disabled.

It is also important to understand that enabling Advanced Data Protection does not make every iCloud sharing method end-to-end encrypted. Apple’s existing security documentation identifies several exceptions, including sharing with anyone who has a link.

For particularly sensitive information, users should not assume that a publicly accessible link provides the same privacy protections as a private, end-to-end encrypted conversation or file-sharing arrangement.

The Bigger Picture

Apple has built much of its privacy positioning around device-level security, encryption and limiting the company’s access to customer information. Its latest iCloud policy demonstrates the tension between those principles and the responsibility technology companies face when distributing publicly accessible content.

The distinction between private cloud storage and public sharing is central to understanding the change. A file stored privately in iCloud is not equivalent to a file deliberately made accessible to anyone with a link.

At the same time, the policy raises legitimate questions about how companies define harmful content, how automated checks are conducted and what protections users have when content is incorrectly flagged.

The decision also reflects a wider industry debate about the balance between privacy, platform responsibility and the prevention of illegal material being distributed through online services.

Looking Ahead

The implementation of Apple’s new policy will be closely watched by privacy advocates, security researchers and users who rely on iCloud for sharing photographs and documents. Greater clarity about the categories of content being checked, the review process and the handling of false positives will be important for building user confidence. The December rollout of the 27.3 software updates should provide a clearer picture of how the policy operates in practice.

For Apple users, the most practical lesson is that public sharing and private storage offer different levels of protection. Advanced Data Protection remains an important security feature, but it does not extend end-to-end encryption to content shared through “Anyone with the Link.” Users who want tighter control over sensitive files should choose restricted sharing permissions and regularly review the links they have created.