Apple will scan iCloud items shared by open link from version 27.3

Apple will scan iCloud items shared by open link from version 27.3

3 November 2026: Apple says that from version 27.3 of iOS, iPadOS, macOS and visionOS, anything in iCloud shared with "Anyone with the Link" will be checked for harmful content, and that such an item is no longer end-to-end encrypted even when the owner has Advanced Data Protection turned on. Staff who share work files by open link will fall under this.

Not yet independently verified. Apple gives no release date for version 27.3, and does not say how it defines harmful content or whether links created before 27.3 are covered. Apple's support article is the only primary source. We will update this when it can be confirmed, and remove this note.

Which sharing option is affected

The change sits inside a choice users already make. An item stored in iCloud, such as a photo in iCloud Photos or a file in iCloud Drive, can be sent as a copy or shared as a link. A link can go to "People you choose", meaning only those invited or approved, or to "Anyone with the Link", which Apple now says makes the item accessible to anyone holding the link, Apple included. The support article describes checks only for the second option.

Advanced Data Protection is Apple's setting for end-to-end encryption across most of iCloud. Its removal for open-link items is stated plainly: to make the sharing work, the item loses that protection, for the owner and for participants.

What Apple can do to an account

The consequences reach well beyond the file. If harmful content is uploaded, Apple "reserves the right to move, refuse, modify, remove, or delete the content at any time". It may block or disable the Apple Account, stop a new account being created with the same email address or phone number, and involve law enforcement "if necessary". The article adds that not all features are available in all countries or regions.

Questions the article leaves open

Three things matter to anyone managing Apple devices at work, and Apple answers none of them. The article has no release date for 27.3. It does not define harmful content. It does not say whether links created before the update are checked once a device moves to 27.3. Managed Apple Accounts, the kind issued by an organisation, are not mentioned either, so an administrator cannot tell from this page whether an automated finding could disable a work identity.

Where to act before the update lands

Organisations that allow iCloud Drive for work can use the time before 27.3 to decide whether files containing client or personal data may leave by that route at all. Where a recipient is known, "People you choose" remains the option the article does not place under these checks. Any data protection assessment that relied on Advanced Data Protection for iCloud sharing should be reread with this exception in mind.

Related listings

iCloud is listed in our file sharing category, and our cloud storage software category holds eight products for teams comparing other link-sharing models.

Related on TrustList:

• Dropbox plans to buy object storage firm Tigris Data
• NetApp StorageGRID login bypass leaves branches 11.3 to 11.8 unfixed

Sources

• Apple Support: Learn more about sharing content that can be accessed by Anyone with the Link, 3 November 2026
• iThome: report on Apple checking publicly shared iCloud items, 9 November 2026