On November 3, 2026, Apple announced in an official support document that content shared through public links on iCloud will newly be subject to screening for harmful content. The change applies to iOS, iPadOS, macOS, and visionOS version 27.3 and later, and covers items shared with the "Anyone with the link" setting. With this method, anyone who has the link can access the content, and, unlike an invitation to specific people, Apple can also access what is shared. It has long been the case that sharing via public links falls outside end-to-end encryption. What is new is the screening for harmful content. Apple has indicated that if a violation is found, it may take action beyond removing the content, including suspending the account.
The "Anyone with the link" setting is what gets screened
The key point of this change is that not all data stored in iCloud will be screened. What Apple has explicitly named as covered is items saved in iCloud Photos, iCloud Drive, and similar services that are shared with the "Anyone with the link" setting. This is not an announcement of constant scanning of ordinary saves or of data that has not been shared.
iCloud offers several ways to share. When sharing photos or files, for example, you can choose between "Send a copy" of an item and "Share a link" for accessing the original item. When you use a shared link, you can choose between "Only people you invite" or approve, and "Anyone with the link," which lets anyone who has the link get in. The screening applies to the latter, and Apple explains that content shared through public links will be subject to screening for harmful content.
Although Apple specifies 27.3 and later as the target operating system versions, it has not given a specific general availability date or detailed conditions for availability in Japan. Individual invitations and copy sending are not listed as targets of this screening, but that does not mean they are exempt from every form of screening. What can be confirmed from this announcement is only that sharing via public links becomes subject to new screening.
Public links were already outside end-to-end encryption
To understand this change, it helps to sort out how iCloud's encryption relates to its sharing features. Apple's "Advanced Data Protection for iCloud" protects most data stored in iCloud with end-to-end encryption. When it is enabled, the decryption keys for covered data are, in principle, held only by the user's trusted devices, and Apple itself can no longer decrypt it. With Standard Data Protection, by contrast, data is encrypted in transit and at rest, but the decryption keys are managed in Apple's data centers.
However, even with Advanced Data Protection enabled, sharing via public links is an exception. According to Apple's "iCloud data security overview" (Japanese version), when content is shared using "Anyone with the link," the encryption keys for the shared content are securely uploaded to Apple's data centers so that it can be accessed via the web. As a result, the shared content falls outside end-to-end encryption and is in a state Apple can decrypt. This does not mean encryption disappears; it means the way the decryption keys are managed changes.
This exception was not newly created in November 2026. Apple's data protection explanation, published with a date of January 5, 2026, also states that public link sharing is not covered by Advanced Data Protection. However, January 5 is the publication date shown on the document and does not indicate when the specification was introduced. In addition, what we checked was the current version of the document as of November 5; we did not verify earlier versions or how things worked at the time.
The differences between sharing methods can be summarized from three perspectives: who can access, encryption, and whether the method is covered by this screening.
| Sharing method | Who can access | End-to-end encryption | Covered by this screening |
|---|---|---|---|
| Public link | Anyone with the link | Not covered | Covered from 27.3 |
| Individual invitation | People who are invited or approved | Available when the feature supports it and all participants have Advanced Data Protection enabled | Not stated as covered |
It is worth noting that limiting who you share with does not by itself guarantee end-to-end encryption. Even with individual invitations, all participants must have Advanced Data Protection enabled, and the sharing feature being used must itself support it. With public links, by contrast, content is outside end-to-end encryption regardless of such conditions. This change adds harmful content screening on top of that existing specification.
Not just content removal but account suspension; criteria not disclosed
The actions Apple outlined in this notice go beyond deleting shared content. Apple explains that if someone attempts to upload harmful content, it reserves the right to move, reject, modify, remove, or delete that content. It also lists as possible measures blocking or disabling an Apple Account and prohibiting the creation of new accounts using associated email addresses or phone numbers. It also mentions that law enforcement may become involved where necessary.
However, these are actions Apple indicates it may take, and they do not mean an account will necessarily be suspended whenever harmful content is detected. It also remains unclear what kinds of violations would lead to what degree of action. Because deleting content and disabling an account affect users very differently, the criteria for deciding on actions are important.
A further issue is that Apple has not given a specific definition of "harmful content." There is no explanation from which one could conclude that screening is limited to particular types, such as child sexual abuse material or malware. It is also unclear whether determinations are made by human review, by automated systems, or by a combination of both. Whether specific technologies such as AI image recognition, hash matching, or on-device scanning are used has not been disclosed.
How misjudgments will be handled is also opaque. The notice does not describe a dedicated procedure for users to appeal when legitimate content is judged harmful, or a mechanism for restoring deleted data. Since screening could affect not only the content but the entire account, transparency about the criteria and remedies will be an important point in evaluating how this is operated going forward.
Using iCloud safely means checking both who can access and how it is encrypted
Given this change, when sharing files or photos in iCloud it is important to check not only who can access them but also which encryption method applies. When collaborating with specific people, using individual invitations rather than public links lets you limit who can access the content. To maintain end-to-end encryption as well, you need to confirm that all participants have Advanced Data Protection enabled and that the sharing feature supports it.
According to Apple, features such as iCloud Shared Photo Library, shared folders in iCloud Drive, shared Notes, and Freeform collaboration can maintain end-to-end encryption while shared, provided the conditions are met. On the other hand, iWork collaboration and the Shared Albums feature in the Photos app do not support Advanced Data Protection. Even within Apple's services, the conditions for protection differ depending on the app and sharing feature used.
Nor does sending a copy instead of using a public link avoid every encryption or screening concern. Under Apple's existing explanation, there is an exception in Freeform: when "Send a copy" is used, the board is stored without encryption while the shared link is active. Although copy sending is not explicitly named as a target of this screening, changing the sharing method does not necessarily guarantee safety.
What this announcement makes clear is that content shared through iCloud public links becomes newly subject to screening, and in some cases action may extend to the Apple Account. Still unclear are the definition of harmful content, how determinations are made, remedies for misjudgments, and how far this applies to existing shared links. How specifically Apple explains these conditions going forward will be important for assessing user privacy and the transparency of content moderation.