Opens in a new tab
News and views on tech

iOS 27.3 has Apple checking public iCloud links for harmful content

Apple could already see these files, but now it says it will finally look.

The iCloud website in a browser window, with tiles for a user's profile, Photos, Mail and Drive on a blue background
iCloud on the web, with Photos, Mail and Drive Image: Apple

Apple says it will now start checking the photos and files you share through iCloud’s “Anyone with the link” option for any harmful content. From version 27.3 of iOS, iPadOS, macOS, and visionOS, content “is made accessible to Apple to check for harmful content,” it officially says in a new support document.

To be clear, public links aren’t hidden from Apple. The page says this option makes an item “accessible to anyone who has the link, including Apple,” and Apple’s iCloud terms already say it may screen content and remove it. Now, it says these items “will be checked.”

Apple’s page doesn’t directly define harmful content. It also doesn’t say how the check works, whether a person ever sees a flagged item, or whether links made before 27.3 are going to be included.

Apple’s penalties reach past the file itself. It can move, refuse, modify, remove or delete flagged content. It can also block or disable your Apple Account, stop that email address or phone number from opening a new one and, “if necessary,” involve law enforcement. That section talks about trying to “upload” harmful content, not just sharing it.

The page’s line that a shared item is “no longer end-to-end encrypted,” even with Advanced Data Protection on, may sound like a change but it isn’t. Apple’s Advanced Data Protection page has said so since at least January 2023. iCloud’s servers need the keys to hand a file to whoever opens the link.

Back in 2021, Apple announced a plan to scan photos stored in iCloud for child sexual abuse material (CSAM). But it dropped the plan in December 2022 after criticism from privacy and security researchers. “Children can be protected without companies combing through personal data,” Apple told Wired in a statement. This new page doesn’t mention that plan at all, and the check it describes covers only public links.

iOS 27.3 is in developer beta now, and Apple says it arrives in December. The page names only “Anyone with the link,” so “People you choose” links and Send a Copy sit outside the check it describes – for now.

The take

We’re fine with Apple checking files that are public by design. The penalties are harder to accept, because they can reach your whole Apple Account under a term Apple hasn’t clearly defined yet. At the very least, we think a rule that can lock you out of your account should say what breaks it before iOS 27.3 ships.

In case you missed it