Apple has told iCloud users that anything shared through the “Anyone with the Link” option will be checked by the company for harmful content once devices run version 27.3 of iOS, iPadOS, macOS or visionOS. The same support page says an item shared that way is no longer end-to-end encrypted, even when the owner or other participants have switched on Advanced Data Protection. Apple published the notice on Nov. 3, while the 27.3 software was still in developer beta.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The change is narrow in scope and large in principle, because it moves one category of iCloud content from a hands-off posture to an inspected one. Photos and files sent to named recipients are not described as part of the check, but a public link is a different object: it opens for anyone who holds the address, Apple included, and Apple has now said in writing that it will look.
Apple’s support page on the 27.3 link check
The wording comes from Apple’s own support document. Beginning with version 27.3 across iOS, iPadOS, macOS and visionOS, items shared using Anyone with the Link “will be checked by Apple for harmful content,” and the page notes that such content is made accessible to Apple for that purpose. Examples include an iCloud Photos image or an iCloud Drive file turned into a public link.
Apple does not call the process a scan, but the press has read it that way. iPhone in Canada, for one, reported that in the 27.3 releases Apple will scan items shared through the public option, and that those shares will no longer stay end-to-end encrypted. The mechanism remains undisclosed. Apple has not said whether the check relies on hash matching, machine-learning classifiers, human reviewers or some mix, and it has not said how often a link would be examined, whether at the moment of sharing, on a schedule, or each time somebody opens it.
Encryption: why a public link was never private
Standard iCloud protection already leaves Apple holding the keys for Photos and Drive. Advanced Data Protection, the optional setting that moves those keys onto trusted devices, is the feature that normally gives iCloud end-to-end encryption. According to iThinkDifferent’s explainer, a link that opens in any web browser cannot be end-to-end encrypted because Apple keeps what it needs to serve the page, so the new notice mostly states a technical fact in policy terms. Shared folders and shared Notes can stay end-to-end encrypted if every participant has Advanced Data Protection on.
That framing draws the line the company wants: encryption applies to the private copy in a person’s account, and a public link is publishing. The notice still reaches a user who enabled Advanced Data Protection to limit exposure, because sharing by public link overrides the setting for that single item without changing anything else in the account.
Enforcement powers and the objections already raised
The page lists consequences. Apple may move, refuse, modify, remove or delete the content at any time, may block or disable the sender’s Apple Account, may bar a new account from using the same email address or phone number, and may involve law enforcement. 9to5Mac’s Ryan Christoffel pointed out that public links were already reachable by Apple, so the new element is active checking rather than access.
The loudest objection concerns the undefined phrase “harmful content”. At The Register, writer Brandon Vigliarolo argued that without a definition, users are essentially left at Apple’s mercy. He added that Apple has not said whether people, automated systems or AI will make the calls, noted that AI moderation can be fooled, and wrote that Apple did not answer his questions. The Register also reported that 27.3 reached developers in beta on Nov. 3 with general release expected in December. The top reader comment on 9to5Mac, from a user named Scott D., backed the idea but asked Apple to publish guidelines, saying the single word “harmful” leaves too much open to arbitrary interpretation.
History frames the unease. As iThinkDifferent recounts, Apple confirmed in 2021 that it had checked iCloud Mail for child-abuse imagery since 2019, since mail is not end-to-end encrypted, and in December 2022 it dropped its plan to detect such material in iCloud Photos. The 27.3 policy takes a middle path that avoids touching private libraries and covers only what a user chooses to publish.
Two practical points follow for anyone who shares by link, whether a vacation album sent to relatives or a work document dropped into a group chat. A person who wants an item to stay out of Apple’s review can share it with named people instead, and not every feature ships in every country or region, a caveat Apple included on the page without naming any market. Which countries will see the checks first, and what counts as harmful, are the open questions the support page leaves unanswered.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
