iCloud Photos encryption and Advanced Data Protection
Two levels of protection
Apple has two settings for iCloud. Think of two kinds of safe-deposit box. In one, the bank keeps a spare key in case you lose yours. In the other, there is only your key.
- Standard data protection is the default. Photos are encrypted while they travel and while stored, but Apple keeps the keys in its data centres. That lets Apple help you recover your data. It also means Photos isn't end-to-end encrypted.
- Advanced Data Protection is optional. Apple calls it its highest level of cloud data security. Your trusted devices hold the keys for most of your iCloud data, and Apple can no longer read it or recover it for you.
What Advanced Data Protection covers
Apple lists the extra categories it makes end-to-end encrypted, including iCloud Backup, iCloud Drive, Photos, Notes, Reminders, Safari Bookmarks, Shortcuts, Voice Memos, Wallet passes and Freeform. Some data is end-to-end encrypted without it, such as saved passwords and Health data.
What stays outside, even with it on
- Mail, Contacts and Calendars aren't end-to-end encrypted. Apple says Mail has to work with the rest of the world's email.
- Shared Albums in Photos aren't supported. Photos you add to one are stored with standard protection.
- "Anyone with the link" sharing stays available to Apple's servers.
- Sharing with others keeps content protected only if everyone has it turned on.
- Some details, such as modification dates and checksums (a short fingerprint of a file), are encrypted, but under standard protection Apple holds those keys.
What you need, and the trade-off
- An Apple Account with two-factor authentication, a passcode set on your device, and all devices signed in to your account updated to a supported version (iOS 16.2 or later on iPhone). Managed Apple Accounts and child accounts aren't eligible.
- A way to get back in. Apple can't recover this data, so you have to set up a recovery contact or a recovery key first. Your device passcode or password also works for recovery, so it's worth keeping private. If every method fails, Apple can't help.
- iCloud.com web access is turned off when you switch it on. You can turn it back on, but you can turn it back on by approving temporary access from a trusted device.
- You can turn it off whenever you like, and your account goes back to standard protection.
Where it isn't offered
Apple's page about the United Kingdom says users there who hadn't already switched it on can no longer do so, and that it continues to be available everywhere else, though Apple also says it may not be available in every country or region. Apple says it hopes to bring it back there. This can change, so check Apple's own page for where you live.
What it doesn't do
- It doesn't protect an unlocked iPhone. Someone holding your phone and knowing your passcode is a different problem. Here's what to do.
- It doesn't protect copies on other devices or services that you've already sent pictures to.
- It doesn't add a second lock. Pictures are still open to anyone who gets into your Photos app.
How FirstHour fits in
FirstHour's Vault is separate from iCloud. What's in the Vault isn't in iCloud Photos, and FirstHour doesn't send your pictures to Apple or anyone else. If you use iCloud Photos, your iPhone may download a picture from your iCloud so FirstHour's check can read it, which is a download, not an upload. Originals left in Photos stay in iCloud Photos. For a second lock on top of any setting, the Vault is made for that, with the limits listed here.
Questions
Should I turn it on?
It's your call. It keeps Apple from being able to read your own library photos, with the few exceptions listed above, but if you lose every way back in, they're gone for good. Set up a recovery contact or key first.
Can I try it and change my mind?
Yes. Apple says you can turn it off at any time, and your account returns to standard data protection.
Sources
- iCloud data security overview, Apple Support
- How to turn on Advanced Data Protection for iCloud, Apple Support
- Advanced Data Protection for iCloud, Apple Platform Security
- Apple can no longer offer Advanced Data Protection in the United Kingdom to new users, Apple Support