Apple will start checking iCloud public links for harmful content with iOS 27.3, as per the latest update from Apple. Flagged content can be removed, and the Apple Account behind it can be blocked or disabled.
The check covers items shared with the Anyone with the link option in version 27.3 of iOS, iPadOS, macOS and visionOS, such as a photo in iCloud Photos or a file in iCloud Drive. Items shared this way are also not end-to-end encrypted, even when Advanced Data Protection is turned on.
Apple can open iCloud public links and will now check them
iCloud gives you two ways to share an item stored there, Share a Link and Send a Copy, which passes along the item itself instead of a link. Share a Link then splits into People you choose, which limits access to the people you invite or approve, and Anyone with the link, which lets whoever holds the URL open the item. Apple is part of that group, so a public link is not private from the company.
Most accounts use standard data protection, where Apple holds the keys to iCloud Photos and iCloud Drive, while the optional Advanced Data Protection setting moves those keys to your trusted devices only. A public link overrides that for the shared item, because Apple keeps the keys to it so the link can open on the web. The same setting can keep shared iCloud Drive folders and shared Notes end-to-end encrypted when every participant has it turned on.
Flagged content can be removed and the Apple Account blocked
Apple can move, refuse, modify, remove or delete flagged content at any time. On the account side, it can block or disable the Apple Account, and it can stop a new account from being created with the same email address or phone number. Apple can also involve law enforcement if necessary.
Apple has not said what counts as harmful content or how the check works. It published the support page on November 3, the day iOS 27.3 beta 1 went out to developers, and iOS 27.3 is still in developer beta. Apple also notes that not all features are available in all countries or regions.
Apple confirmed in 2021 that it had been scanning iCloud Mail for CSAM since 2019, because mail is not end-to-end encrypted. It dropped its CSAM detection plan for iCloud Photos in December 2022 and shifted its focus to Communication Safety in Messages.
