“Items shared using Anyone with the Link will be checked by Apple for harmful content,” Apple explained on the new help page.
Apple's planned change: scanning public iCloud links in OS 27.3
Apple will begin checking content on publicly accessible iCloud share links in version 27.3 of iOS, iPadOS, macOS, and visionOS, according to a new support page published on Tuesday. The scans apply only to items shared using the “Anyone with the Link” option — links created to be accessible by anyone rather than content shared directly with specific people. The company made the change public in the documentation for the upcoming software release, which was delivered to registered developers in beta on Tuesday; Apple expects a general release in December.
What Apple says it will do to shared items
Apple’s help page states that it can access items shared via “Anyone with the Link” and that those items “will be checked by Apple for harmful content.” The company warns that “if you try to upload harmful content, Apple reserves the right to move, refuse, modify, remove, or delete the content at any time.” The page also says Apple may block or disable accounts associated with harmful content and that it reserves the right to involve law enforcement when necessary.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildEncryption, Advanced Data Protection, and access
Apple’s documentation also explains a technical consequence of choosing the public-share option: the share-with-anyone setting removes end-to-end encryption for the shared item. That removal applies even when an account has Advanced Data Protection enabled. In short, items made accessible to anyone via a public link are no longer protected by the end-to-end encryption that otherwise applies to supported iCloud data under Advanced Data Protection, according to the support page.
Unspecified definitions and detection methods
The support page does not define the term “harmful content,” nor does it explain how Apple will perform checks on public links. The company has not disclosed whether identification and removal would be carried out by human moderators, automated systems, or a mix of both, and it has not described whether or how AI might be used to make moderation decisions. The Register’s reporting also notes the support page suggests the undefined “harmful content” category could encompass child sexual abuse material (CSAM), malware, and “other potentially unlawful content.”
What this means for technologists, end users, and policymakers
- Technologists and security teams: Engineering and security teams will need to account for the fact that publicly shared iCloud links are no longer end-to-end encrypted per Apple’s page, and they will likely watch for technical details about detection methods and false-positive rates once the feature ships.
- End users and the general public: Users who rely on public iCloud links for sharing should note Apple’s explicit right to move, modify, remove, or delete content and to block accounts tied to what it deems harmful, even when an account has Advanced Data Protection enabled.
- Policymakers and regulators: The documentation’s lack of a narrow definition for “harmful content,” plus Apple’s stated right to involve law enforcement, presents definitional and procedural questions that regulators or policymakers may scrutinize if public-link moderation becomes a widespread enforcement mechanism.
The Register’s coverage also flagged the practical implications of an undefined standard: “If it chooses to continue to bend the knee to the Trump administration, for example, content deemed objectionable by the standards of political figures could end up wiped out,” the outlet wrote — a line that frames one of several editorial concerns raised by the change.
Apple did not provide additional comment to The Register; the help page is the company’s current public statement on the policy.
Apple’s scanning of public iCloud links is set to begin with OS version 27.3, rolling out from the developer beta published Tuesday toward a general release expected in December — a schedule that will give users, developers, and oversight bodies only weeks to seek clarity on definitions and detection methods before the feature goes broadly live.
Source: The Register — Apple turns iCloud into spy cloud, will start looking at public share links
