Apple to Scan Link-Shared iCloud Items for Harmful Content From iOS 27.3
Apple plans to begin checking iCloud items shared with Anyone with the Link for harmful content starting with iOS 27.3 and other 27.3 updates. The company plans to launch iOS 27.3 in December.
The change covers a single sharing mode. Apple defines the iCloud Drive Anyone with the Link option as allowing anyone who receives the link to access the file or folder. In version 27.3 or later of iOS, iPadOS, macOS and visionOS, content shared under that permission is made accessible to Apple so that it can check for harmful content. Items shared this way will no longer be end-to-end encrypted, meaning the content is scrambled on the sender's device and only the devices holding the decryption keys can read it.
That last point reverses a default many users may assume still applies. Apple's support documentation states that, under standard data protection, iCloud content shared with other people is not end-to-end encrypted. Its Advanced Data Protection documentation goes a step further: selecting the Anyone with a link option when enabling collaboration makes that content available to Apple servers under standard data protection. Advanced Data Protection users who turn on link sharing have therefore already been moving those items outside end-to-end encryption. The 27.3 change extends that treatment to link-shared items as a category and applies the server-side check to them.
Apple also set out how it will act on content it finds. It reserves the right to move, refuse, modify, remove or delete any harmful content that a user attempts to upload. It may block or disable accounts, prevent a user from making a new account, or invoke law enforcement if necessary in connection with harmful content. The enforcement provisions go well beyond removing a file, and they reach the account itself.
The broader context here is architectural. Apple's encryption model rests on the principle that the server holds ciphertext, the scrambled form of data, which it cannot read. Link-based sharing is the mechanism that makes a file reachable by people outside the owner's account, so it is the point where the company has chosen to carve out an exception. Experts will want to see how the check is implemented, what triggers it, and how the boundary between encrypted and server-readable items is communicated to users at the point of sharing. Those details will show whether the change stays contained to link sharing or spreads into other parts of iCloud over time.
In my view, the practical consequence is easy to state and harder to live with. A user who creates a shared album or folder link for a family group, a studio collaborator or a client has been trusting that the link itself is the only gate. From iOS 27.3, that link also opens a path for Apple to read the content and act on it, including at the account level. Some users will weigh that as a reasonable trade for a platform that polices the most widely distributed material. Others will see a precedent for server-side access in a service marketed on privacy.
For now, the facts are narrow: a planned change, a defined sharing mode, a stated loss of end-to-end encryption for items in that mode, and a list of enforcement powers. The launch timing rests on the December plan for iOS 27.3. Users who want to keep content fully encrypted have a clear option, which is to share through means other than an Anyone with the Link permission.
