Apple to Scan Publicly Shared iCloud Photos and Files for Harmful Content Starting With iOS 27.3

Apple will start checking iCloud photos and files shared through “Anyone with the Link” for harmful content beginning with iOS 17.3. This policy also applies to iPadOS, macOS, and visionOS version 17.3 or later. It distinguishes between publicly accessible sharing links and content that is restricted to specifically invited recipients.

The change appears in an Apple support document published November 3, 2026. Apple states that choosing this sharing option makes the selected item accessible to anyone possessing its link, including Apple. The document identifies photos stored in iCloud Photos and files stored in iCloud Drive as examples of covered content.

Public Links Change the Encryption Boundary

The technical details pertain to encryption. Apple states that items shared using the “Anyone with the Link” option are no longer end-to-end encrypted to facilitate sharing. This holds even when the owner or other participants have enabled Advanced Data Protection, an optional feature that extends end-to-end encryption to additional categories of iCloud data.

This distinction is important because Advanced Data Protection typically restricts decryption of protected information to trusted devices. However, sharing a public link creates an exception for the shared item; enabling account-level protection does not override this. Therefore, Apple’s notice applies to checks on publicly accessible material, not blanket scanning of every private iCloud photo, document, or device backup.

Users who select “Share a Link” can choose “People You Choose,” which limits access to individuals they invite or approve. Additionally, Apple differentiates link sharing from “Send a Copy.” The announcement specifically links harmful content checks to the “Anyone with the Link” option, rather than suggesting that all sharing methods are subject to the same level of inspection.

If harmful content is uploaded, Apple reserves the right to move, refuse, modify, remove, or delete it. Enforcement may extend beyond individual files: the company can block or disable an Apple Account and prevent creation of another account using the associated email address or phone number.

Apple also says it may involve law enforcement when necessary. However, the notice does not define harmful-content categories, identify detection technologies, or explain review procedures. It provides no technical basis for concluding that the system uses on-device scanning, particular machine-learning models, or a specific hash-matching implementation. Regional feature availability may also differ.

The announcement adds another dimension to scrutiny of Apple’s cloud privacy architecture, following changes to Advanced Data Protection in the UK and government demands for access to encrypted iCloud information. Those disputes concern encryption access; this notice addresses content users deliberately make accessible through unrestricted links, a materially different scope.

For security teams reviewing the announcement, the documented boundary is the sharing permission attached to each item, not simply whether its owner has enabled Advanced Data Protection.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.