Apple is about to start inspecting files and photos that people share from iCloud through public links. A support document published on 3 November says that from version 27.3 of iOS, iPadOS, macOS and visionOS, any item shared with the “Anyone with the link” setting “will be checked by Apple for harmful content”.
The change is narrow in scope but significant for a company that walked away from a broader scanning plan after proposing it in 2021, and it arrives with almost no detail about how it will work.
Only public links, but every public link
iCloud gives users three ways to share a photo from iCloud Photos or a file from iCloud Drive. They can send a copy, share a link with “People you choose”, or share a link that works for “Anyone with the link”. Apple’s new page says the third option makes the item accessible to anyone who has the link, “including Apple”, and that those are the items that will be checked. Links limited to invited people, and copies sent directly, are not mentioned as part of the checks.
If something is judged harmful, Apple says it can “move, refuse, modify, remove, or delete the content at any time”. It may also block or disable the Apple Account, stop the same email address or phone number from being used to open a new one, and “if necessary” involve law enforcement.
What Apple hasn’t said is just as important. The page doesn’t define harmful content, explain whether checks are automated or done by people, or say whether links created before 27.3 will be checked. MacRumors notes the last point is unanswered, and The Register says Apple didn’t respond to its questions. Both outlets suggest the reference to police points to child sexual abuse material and malware, but that’s inference, not Apple’s wording. There’s also no mention of an appeal process.
The 27.3 releases went to developers in beta on 3 November, according to The Register, and both outlets expect a public release in December. Apple’s page adds that “not all features are available in all countries or regions”, without saying where this one applies.
What it does and doesn’t change about encryption
It’s tempting to read this as Apple breaking encryption. That isn’t what the documents say.
Apple’s iCloud data security overview already states that sharing content with “anyone with the link” doesn’t support Advanced Data Protection, Apple’s optional end-to-end encryption mode. To make web sharing work, the encryption keys for the shared item are uploaded to Apple’s data centres, so the item is not end-to-end encrypted even if Advanced Data Protection is on. The new page repeats that. And for most users, who use Apple’s default standard data protection, iCloud Photos and iCloud Drive aren’t end-to-end encrypted in the first place; Apple holds the keys.
So Apple has long had the technical ability to see public-link content. What’s new is a stated policy of looking at it, plus explicit penalties.
A careful line after the 2021 retreat
That distinction matters because of Apple’s history. In 2021 it proposed a system to detect known child abuse images in iCloud Photos, then abandoned it after criticism from privacy and security researchers. In a January 2024 submission to Australia’s eSafety Commissioner, Apple explained that it had concluded such scanning “was not practically possible to implement without ultimately imperiling the security and privacy of our users”, and warned that scanning every user’s privately stored iCloud data would pose serious security and privacy problems.
The new policy appears designed to stay on the other side of that line. Content you share with the world through a link isn’t privately stored in any meaningful sense, and Apple can already read it. Critics will still want to know whether the scope can grow, and how false positives will be handled when the penalty can be losing access to an entire account, including photos, backups and email.
The Australian context
Australia is one of the places where this question isn’t abstract. eSafety’s Designated Internet Services standard, which came into force on 22 December 2024, requires file and photo storage services, naming Apple iCloud, Google Drive and Microsoft OneDrive, to take steps to prevent them being misused to store and distribute child sexual abuse and pro-terror material. Apple hasn’t linked its new policy to Australian law or any other regulation, and it hasn’t said whether the checks will run in Australia. But public sharing links are exactly the kind of distribution route regulators have pointed to.
If you use public links
For most people this is a reason to be deliberate rather than alarmed. Public links are useful for sending a big video to a group chat or a set of files to a client, and many people treat them as private because the address is hard to guess. Apple’s wording makes clear they aren’t private.
For anything personal, sharing with “People you choose” keeps it within Apple’s invitation system and outside the scope Apple has described. When the recipient just needs the file, sending a copy works. And it’s worth reviewing old public links in Photos and Files now, since Apple hasn’t said whether existing links will be swept up once 27.3 arrives.
Update, 8 November 2026: An earlier version of this article said Apple hadn’t given a release date for 27.3. Apple still hasn’t announced one; the December timing above comes from MacRumors and The Register, which report the betas reached developers on 3 November.
