Apple Expands Content Scans to Public iCloud Shares

"Starting in version 27.3 or later of iOS, iPadOS, macOS, and visionOS, items shared using Anyone with the Link will be checked by Apple for harmful content," Apple said in a support document published Tuesday.

What Apple announced for iOS 27.3, iPadOS 27.3, macOS 27.3 and visionOS 27.3

Apple said it will begin checking items that users share via public iCloud links for "harmful content" when those links are created or used on devices running version 27.3 or later of iOS, iPadOS, macOS, and visionOS. The company framed the change specifically around scenarios in which a user shares iCloud content — for example, photos in iCloud Photos or files in iCloud Drive — by choosing the "Anyone with the link" option.

"Anyone with the link": access, privacy, and encryption

Apple emphasized that choosing "Anyone with the link" makes the shared content accessible to anyone who has the link, "including Apple," and that this sharing option disables end‑to‑end encryption even if the owner or recipients have enabled Advanced Data Protection. Advanced Data Protection is an optional setting that secures iCloud Backup, Photos, and Notes using end‑to‑end encryption; according to Apple, that protection does not apply to items shared via the public‑link option.

Removal and account actions Apple says it may take

The company warned that if users attempt to upload harmful content through publicly shared links, that content "can be removed or deleted at any time." Apple added that it may also take action against an Apple Account, including "blocking or disabling your Apple Account, blocking the ability to create a new Apple Account with the associated email address or phone number," and, "if necessary, involving law enforcement."

Ambiguities Apple left in its support document

• Apple did not define in the published notice what it considers "harmful content," and the company itself said that is unclear in the document.
• The support text did not say what prompted the policy change.
• It is also unclear whether the checks will be applied retroactively to previously generated public links or to new links created before the version 27.3 updates are rolled out later this December.

What this means for end users, security teams, and threat actors

• End users: Anyone who wants to make content accessible via a public iCloud link should understand that Apple will be able to access and check that content and that doing so disables Advanced Data Protection's end‑to‑end encryption for the shared items.
• Security teams and technologists: Teams responsible for data protection and compliance will need to account for the distinction between private, E2EE‑protected iCloud content and items made public with "Anyone with the link," and they may watch for how Apple defines "harmful content" and whether checks are applied retroactively.
• Adversaries or abusive actors: Apple explicitly warned that it may remove content, disable or block Apple Accounts tied to uploads, prevent creation of new accounts with the same email or phone number, and, if necessary, involve law enforcement — actions the company says it may take against users who upload harmful content via public links.

Apple plans to begin these checks when the 27.3 updates arrive later this December, but the support document leaves key details unspecified: the criteria for "harmful content," the triggers for enforcement, and whether existing public links will be rechecked. In its notice Apple also set out clear consequences for content removal and account restrictions, including potential involvement of law enforcement, signaling that public iCloud links will no longer sit outside the company's content‑control processes.

Source: https://thehackernews.com/2026/11/apple-to-start-scanning-publicly-shared.html