Apple will check public iCloud links for harmful content starting in iOS 27.3

What Apple announced

The document, titled "Learn more about sharing content that can be accessed by Anyone with the Link" (support.apple.com/en-us/149168), describes the two ways iCloud lets you share an item such as an iCloud Photos image or an iCloud Drive file:

• People you choose - only people you invite or approve can open the item.
• Anyone with the link - anyone who has the URL can open it, and Apple says explicitly that this includes Apple.

In the 27.3 beta, the Sharing Options sheet now carries a notice under the access choices: "Items shared using Anyone with the Link are made accessible to Apple to check for harmful content. Learn more..." 9to5Mac was first to show the new wording in the beta.

Apple also notes that some features vary by country or region, but the document does not say which markets will get the checks.

What happens if content is flagged

The enforcement language is broad. If shared content is found to be harmful, Apple says it "reserves the right to move, refuse, modify, remove, or delete the content at any time." It may also act against the uploader's Apple Account, including blocking or disabling it, and may involve law enforcement "if necessary."

iPhone in Canada reports that enforcement can also extend to blocking the creation of a new account with the same email address or phone number. That detail comes from the outlet's reporting rather than the passage of Apple's document quoted above.

What Apple has not said

The document leaves the most important questions open:

• What counts as harmful content. Apple does not define the term.
• How the checks work. There is no mention of hash matching, machine-learning classifiers, or whether checking happens on the server or on the device.
• Whether links created before 27.3 will be checked, or only new ones.
• Which countries and regions are included, and whether there is any opt-out.

Digital Trends reads the law-enforcement mention as a sign that Apple is looking for things like malware or CSAM, but that is the outlet's inference. Apple has not said the checks are CSAM-specific.

Public links were never end-to-end encrypted

The technical shift is smaller than it may sound. A public iCloud link already removes end-to-end encryption from the shared item, even if the owner or participants have Advanced Data Protection turned on. Apple's iCloud data security overview (support.apple.com/102651) says features such as sharing with anyone with the link do not support Advanced Data Protection, and "this means shared content is not end-to-end encrypted, even when Advanced Data Protection is enabled."

For context, standard data protection end-to-end encrypts 15 iCloud data categories, while Advanced Data Protection raises that to 25, adding iCloud Backup, Photos and Notes among others. iCloud Mail, Contacts and Calendars are not end-to-end encrypted under either setting.

What is new in 27.3 is not Apple's ability to read public links but its stated intent to actively check them, together with the account-enforcement language.

Why it matters: the CSAM backdrop

In August 2021 Apple announced a system to detect known CSAM in iCloud Photos using image hashes supplied by the National Center for Missing and Exploited Children (NCMEC) and other groups. The plan drew backlash from customers, digital-rights groups and security researchers, and in December 2022 it was reported that Apple had abandoned it. Apple later argued that scanning private iCloud data would "create new threat vectors for data thieves to find and exploit."

Since then, the legal pressure has gone the other way:

• December 2024: a lawsuit filed on behalf of a potential group of 2,680 victims sought $1.2 billion over Apple's decision to drop CSAM detection. An Apple spokesperson told The New York Times the company is "urgently and actively innovating to combat these crimes without compromising the security and privacy of all our users."
• February 19, 2026: West Virginia Attorney General JB McCuskey sued Apple, alleging it knowingly allowed iCloud to be used to store and distribute CSAM and that it files far fewer CSAM reports than Google and Meta. The suit seeks punitive damages and an injunction requiring effective CSAM detection.

Both cases are allegations, and Apple has not linked the 27.3 change to either one. But checking only public links lets Apple act on content that is already being distributed - and already outside end-to-end encryption - without reopening the fight over scanning private libraries that sank its 2021 plan.

How to share privately instead

If you would rather your shared files not pass through Apple's checks, the options are the ones Apple's own document points to:

1. When sharing from iCloud Drive or Photos, open Sharing Options and set Who Can Access to People you choose, then invite specific people.
2. Send a copy of the file directly instead of creating a public link, as Digital Trends recommends.
3. Review existing shares and switch any public links that do not need to be public.

Keep in mind that items shared with other people are subject to the encryption rules in Apple's security overview, so sensitive files are best sent in a way that keeps them end-to-end encrypted.

When iOS 27.3 arrives

The first iOS 27.3 developer beta came out on November 3, 2026. Besides the iCloud change, it brings an expanded Siri AI, vertical tabs and adaptive dark mode in Safari, an all-new Apple Health app, Audio Intelligence features for Apple Watch such as Siri Recap and Live Rewind, and Apple's first localized AI features in China.

Apple has not given a release date. Digital Trends expects the stable release in December 2026. The checks are listed for iOS, iPadOS, macOS and visionOS 27.3.

Frequently asked questions

Is Apple scanning my whole iCloud library?

No, based on what Apple has published. The document covers only items shared with Anyone with the Link, not private shares, your full Photos library or on-device content.

Does Advanced Data Protection stop the checks?

No. Sharing an item with Anyone with the Link removes end-to-end encryption from that item even with Advanced Data Protection on, which has been true before 27.3 as well.

What does Apple consider harmful content?

Apple has not said. The document does not define the term or explain how items are checked.

Can I lose my Apple Account over a shared link?

Yes, according to Apple. If content is found harmful, Apple may block or disable the uploader's account and may involve law enforcement if necessary.

Are links I created before iOS 27.3 affected?

Unknown. Apple's document does not say whether existing public links will be checked once 27.3 ships.

Sources

• Apple Support: Learn more about sharing content that can be accessed by Anyone with the Link - https://support.apple.com/en-us/149168
• Apple Support: iCloud data security overview - https://support.apple.com/102651
• 9to5Mac: With iOS 27.3, Apple will start checking iCloud public links for harmful content - https://9to5mac.com/2026/11/04/with-ios-27-3-apple-will-start-checking-icloud-public-links-for-harmful-content/
• Digital Trends - https://www.digitaltrends.com/computing/apple-will-check-your-public-icloud-links-for-harmful-content-and-it-doesnt-rule-out-banning-accounts/
• iPhone in Canada - https://www.iphoneincanada.ca/2026/11/04/apple-icloud-anyone-with-link-harmful-content/
• MacRumors: West Virginia CSAM lawsuit - https://www.macrumors.com/2026/02/19/apple-west-virginia-csam-lawsuit/
• TechCrunch: Apple sued over abandoning CSAM detection for iCloud - https://techcrunch.com/2024/12/08/apple-sued-over-abandoning-csam-detection-for-icloud

Key takeaways

• Starting in iOS, iPadOS, macOS and visionOS 27.3, Apple will check items shared via Anyone with the Link for harmful content.
• Apple does not define harmful content or explain how the checks work.
• Flagged content can be removed, the uploader's account blocked or disabled, and law enforcement involved.
• Public links already lost end-to-end encryption even with Advanced Data Protection; the active checking is what is new.
• To keep shares out of the checks, use People you choose or send a copy instead of a public link.