Apple will check iCloud items shared by public link, from iOS 27.3

01What changes, and what Apple has not said

When you share a photo from iCloud Photos or a file from iCloud Drive, you can send a copy or share a link. A link goes either to “People you choose”, meaning only people you invite or approve, or to “Anyone with the link”, which, Apple writes, makes the item accessible to anyone who has the link, “including Apple”. The new check applies to the second.¹

Apple does not define “harmful content”, say how the check is done, or say whether it covers items already shared by link before the update. The note adds that “not all features are available in all countries or regions”.¹ The first 27.3 betas reached developers on 3 November, eight days after 27.2 was released on 26 October; Apple has not given a release date for 27.3.³

The iCloud terms, last revised on 14 September, already reserve Apple’s right to “screen, move, refuse, modify and/or remove Content at any time”, and say Apple has systems designed to limit how long “serious illegal content, including child sexual exploitation and abuse content” stays on the service, which “might include blocking functions and controls on sharing Content between users”.⁴

02The encryption part is not new

Apple’s iCloud security overview, published on 5 January, already said that iWork collaboration, Shared Albums in Photos and sharing with “anyone with the link” “do not support Advanced Data Protection”: the keys for such content are uploaded to Apple’s data centres so iCloud can run the web sharing.² Advanced Data Protection is an optional setting that raises the number of end-to-end encrypted data categories from 15 to 25, adding iCloud Backup, iCloud Drive, Photos and Notes; with it on, shared content stays end-to-end encrypted “as long as all participants” have it on too, in iCloud Shared Photo Library, iCloud Drive shared folders, shared Notes and Freeform collaboration.² Under the default setting, shared iCloud content is not end-to-end encrypted at all.² What 27.3 adds is that Apple will now check what a public link exposes.

Apple announced Advanced Data Protection on 7 December 2022.⁵ The same day it said it had “decided to not move forward with our previously proposed CSAM detection tool for iCloud Photos”, adding: “Children can be protected without companies combing through personal data” (Apple’s statement, as published by WIRED).⁶ The check Apple now describes applies to items their owner has opened to anyone with the link.

03Sharing privately, by Apple's own rules

Share with “People you choose” rather than “Anyone with the link”. For end-to-end encryption of what you share, turn on Advanced Data Protection and make sure every participant has it on; and keep sensitive files out of iWork collaboration and Shared Albums, which Apple says do not support it.²

To watch: the release date of 27.3, and whether Apple says what counts as harmful content.