Share an iCloud Link With Anyone, and Apple Can Check What's Inside

Apple will check iCloud photos and files shared through links that anyone holding them can open, including Apple, adding content screening to its open-link sharing option. ^[2]

The policy will begin with version 27.3 or later of iOS, iPadOS, macOS and visionOS. It applies to the "Anyone with the Link" sharing option, rather than every item stored in iCloud or content shared only with people the owner invites or approves. ^[2]

Apple confirmed the change in a support document published on November 3, 2026. Its first developer test versions of the four operating-system updates became available that day, putting the policy ahead of a general rollout. ^[2][4]

The privacy consequence is immediate to understand, even before the checks begin. A person can send a link to a small, chosen group, but that does not restrict who can open it. Apple says anyone who obtains such a link can access the item, including Apple itself. ^[2]

The company's stated target is "harmful content". Its potential response extends beyond removing a shared file to disabling an Apple Account or involving law enforcement when necessary. ^[2]

A private message does not make a restricted link

The setting at the centre of the change is an access rule. With "Anyone with the Link", possession of the link is enough to open the content. Sending it only to particular people does not turn it into an invitation-only share. Apple's separate "People you choose" option limits access to people the owner invites or approves. ^[2]

That gap explains why an open-access link can feel private. The owner chooses the recipients of the message containing it, while the sharing setting allows a wider audience: anyone else who gets the same link. ^[2] The message and the file have different boundaries.

Apple's document covers content stored in iCloud, including pictures in iCloud Photos and files in iCloud Drive. Its sharing choices also include sending a copy rather than sharing a link. The announced checks concern items made accessible through the open-link option. ^[2]

Advanced Data Protection has an exception

End-to-end encryption keeps the keys needed to read protected data on users' devices, beyond the service provider's reach. ^[3] Apple says content shared through "Anyone with the Link" is no longer end-to-end encrypted, even when the owner or other participants have enabled Advanced Data Protection. That makes the shared material accessible to Apple. ^[2]

Advanced Data Protection is an optional iCloud security setting. For most iCloud data, it keeps the encryption keys on the user's trusted devices. Apple says it cannot decrypt data protected in that way. ^[3]

An encryption key is what allows protected data to be read. Keeping those keys beyond Apple's reach prevents the company from reading the protected content. The open-link sharing exception means users cannot assume that enabling the stronger setting extends that protection to everything they subsequently share. ^[2][3]

The new policy adds content checks to a category Apple already describes as accessible to it. It does not announce checks of every user's entire iCloud library, and it does not describe a way to decrypt the data that remains end-to-end encrypted. ^[2][3]

Broad powers, an undefined threshold

Apple says it may move, refuse, modify, remove or delete content it considers harmful. It also says it may block or disable an Apple Account, prevent another account being created using the associated email address or phone number, or involve law enforcement if necessary. ^[2]

Those powers make the threshold for intervention important. A decision about one shared item could carry consequences for the account behind it. Users need a clear rule before they can understand what puts that access at risk.

Apple has not defined harmful content, explained the detection method or said whether checks will be automated, involve human review or combine both. It has also not specified notice or appeal procedures, what information it will retain, or whether existing links will be checked when the updates arrive. ^[2]

The change follows calls from protesters for Apple to crack down on child sexual abuse material stored in iCloud, according to The Verge. Apple's own document does not identify that material as the sole or specific target of the checks, using the broader phrase instead. ^[1][2]

The next milestone is the release of the software beyond testing. The Verge reported that Apple planned to launch iOS 27.3 in December. The company's developer page confirms that the initial 27.3 betas are available across all four affected operating systems. ^[1][4]