Apple will begin checking photos and files shared through public iCloud links for harmful content with iOS 27.3 and matching updates for iPadOS, macOS and visionOS. The change applies when users select “Anyone with the Link” for an item in iCloud Photos or iCloud Drive, making the content accessible to anyone who obtains the URL—and to Apple for review. Apple’s support documentation confirms the policy.
The new check does not cover every item stored in iCloud. Users can still share content with “People you choose,” which limits access to invited or approved recipients. Apple’s documentation says that content shared through the public-link option will be checked for harmful material beginning with version 27.3 or later of the four operating systems, although it does not define the full scope of “harmful content.”
The privacy consequence is explicit: public-link sharing is not protected by end-to-end encryption, even when a user has enabled Advanced Data Protection. Apple says encryption keys for such content are made available to its servers so iCloud can provide access to anyone who opens the URL. The company’s iCloud security overview likewise lists “anyone with the link” sharing among features that use standard data protection rather than end-to-end encryption.
If Apple flags an upload, it reserves the right to move, refuse, modify, remove or delete the content. The support page also says Apple may block or disable the associated Apple Account, prevent creation of another account using the same email address or phone number, and involve law enforcement when necessary. Those consequences make the policy relevant to organizations that use public iCloud links for file distribution, customer exchanges or incident-response evidence.
Administrators and users should audit existing public iCloud links before deploying the 27.3 updates, revoke links that no longer need to be public, and use “People you choose” for confidential or regulated material. Organizations that require provider-side end-to-end confidentiality should treat “Anyone with the Link” as an exception to their iCloud data-protection policy, regardless of whether Advanced Data Protection is enabled.
