Apple is preparing a significant shift in how it handles content shared through iCloud. Starting with iOS 27.3 and the corresponding updates across iPadOS, macOS, and visionOS, any item shared with the permission “Anyone with the link” will become accessible to Apple for scanning to detect what the company calls “harmful content.” At the same time, that content will lose the end-to-end encryption that protects the rest of a user’s iCloud data. The change was first reported by The Verge, based on an Apple support document that had earlier been circulated by 9to5Mac.
- Scope limited to public links: Only items explicitly shared with “Anyone with the link” are affected; private iCloud libraries remain untouched.
- Encryption trade-off: Publicly shared content will no longer be end-to-end encrypted, giving Apple access to inspect it.
- Broad enforcement powers: Apple reserves the right to remove content, block or disable accounts, and involve law enforcement, though it does not define “harmful content.”
What Exactly Will Apple Review and When?
The key sentence in the support document, according to The Verge, states that when a user shares an item accessible by “anyone with the link” on version 27.3 or later of iOS, iPadOS, macOS, and visionOS, “that content is accessible to Apple to check for harmful content.” Notably, Apple does not define what constitutes “harmful content” in that document.
The change does not apply to a user’s entire iCloud library. It targets only items marked as accessible by “anyone with the link.” Those files become subject to Apple’s inspection and, in the process, lose the end-to-end encryption that safeguards the rest of a user’s data. Content kept private remains as before.
According to The Verge, Apple released the first developer betas of the 27.3 versions yesterday and plans to publish iOS 27.3 in December. The company reserves the right to “move, reject, modify, delete, or remove” any harmful content a user attempts to upload. It may also block or disable accounts, prevent someone from creating a new one, or, “if necessary,” turn to law enforcement. These are broad powers for a category—”harmful content”—that the document itself leaves undefined.
Why Now, and What Does 2021 Have to Do With It?
The move arrives after years of pressure on Apple to act against child sexual abuse material stored in iCloud. The Verge frames the shift against those requests, and it is impossible to read it without recalling what happened in 2021.
That year, Apple announced a system to detect such material directly on the device, comparing photos against a database before they were uploaded to iCloud. The backlash from privacy experts and digital rights organizations was so severe—given the risk of turning every iPhone into a permanent scanner—that Apple eventually shelved the plan and instead expanded end-to-end encryption for iCloud. The current pivot is technically different: it does not scan the user’s device or private library, but rather the content the user chooses to make public via a link, and it does so on Apple’s servers.
“That content is accessible to Apple to check for harmful content.”
For users who need maximum protection, separate tools exist, such as iPhone’s Lockdown Mode and Android’s Advanced Protection, designed for high-risk profiles.
Is This a Privacy Problem for the Average User?
For most people, the direct impact is limited: only content deliberately made public loses encryption. An “anyone with the link” URL was already, by definition, content placed within reach of strangers, so the privacy leap is smaller than the headline suggests. The uncomfortable nuance lies elsewhere: Apple does not say what “harmful content” means while reserving the right to delete it, close accounts, and notify authorities.
This does not happen in a vacuum. Governments around the world are pushing platforms to monitor more and earlier, especially regarding minors, as reflected in the EU report shaping internet restrictions for younger users.
The reading here is that Apple has found the middle path it lacked in 2021: reviewing only what is shared publicly, on the server, without touching the private library or the encryption of the rest of iCloud. It is defensible and likely more proportionate than scanning everyone’s device. But the fine print deserves attention: an undefined category (“harmful content”) combined with the power to delete and to alert police is exactly the kind of clause Apple should clarify before December, not after. The good news is that the company appears to have learned from its mistake five years ago. What remains to be seen is where it draws the line this time.