All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
Those vacation photos of yours, selfies with your family, and even snapshots of important documents that you’ve shared through iCloud could now be scanned by Apple.
A new policy allows Apple to check public iCloud links for harmful content. This applies to the “Anyone with the Link” sharing option, which disables end-to-end encryption and can even lead to account bans or law enforcement action if your content is flagged as harmful.[1]
But Apple hasn’t clarified what would constitute harmful content. Here’s everything you should know about Apple’s policy change and how you can share files and photos safely.
Apple will start checking public iCloud links for harmful content with the rollout of iOS 27.3, iPadOS 27.3, macOS 27.3, and visionOS 27.3.
When you share a file or photo stored in your iCloud using the “Anyone with the Link” option, it becomes accessible to anyone who has that link, including Apple. However, Apple hasn’t disclosed the reason behind this change or what exactly constitutes “harmful content.”
This decision comes after strong protests from WWDC protesters and increasing pressure on Apple to take action against child sexual abuse material (CSAM) stored in iCloud. So, harmful content would probably include CSAM, along with pornographic or illegal content. But note that this is just speculation.
Using the “Anyone with the Link” option also disables end-to-end encryption (E2EE), even if you have Advanced Data Protection turned on. This isn't a new change, but it means Apple can check the content under its new policy.
Also, if users upload or share harmful content, Apple reserves the authority to block or disable their accounts and prevent them from creating new Apple accounts using the same email addresses or phone numbers. It may even involve law enforcement agencies if necessary.
“If you try to upload harmful content, Apple reserves the right to move, refuse, modify, remove, or delete the content at any time,” Apple said in its support document.
Apple’s announcement is pretty short and has left out several questions and gaps in the policy. For starters, there’s nothing mentioned about an appeal or dispute process or whether the scan is automated or carried out by a human team. There’s also no clarity on when the checks are run and how they work.
And then there’s the question of false positives. For instance, a parent’s bath-time photos of a baby might be flagged as CSAM. Plus, are links shared before the 27.3 update also checked? And is there a process to appeal an Apple account ban?
All these questions remain unanswered for now, and until Apple clarifies them, users can only guess how their shared files will be scanned or what could get their accounts locked.
Apple has long faced criticism over how it handles CSAM content stored in iCloud Photos and iCloud Drive. In August 2021, the company announced a system to detect known CSAM images by matching them against a database of CSAM hashes using on-device processing. This way, Apple wouldn't have to directly view users' photos and would instead match their hashes.
However, around 100 policy and rights groups criticized Apple and called on it to abandon the plan. Researchers also raised concerns about potential hash collisions with NeuralHash, which could trick the system into treating two entirely different images as the same.
Apple eventually dropped its CSAM detection plan, saying that “children can be protected without companies combing through personal data.” In light of this statement, the current policy seems like a U-turn. Apparently, Apple is now willing to inspect users’ shared personal data to protect against harmful content, which in all probability would include CSAM.
Speaking of Apple and privacy, the tech giant is also facing backlash over its latest Apple Watch's privacy-invasive audio intelligence features, as well as a fresh lawsuit alleging that the iPhone Photos app illegally scans faces in camera rolls.
When you choose to share a link, you get two options: “People You Choose” and “Anyone with the Link.” If you want to avoid having your content checked under Apple's new policy, select the “People You Choose” option while sharing links. This will make the content accessible only to the people you invite or approve.
Although Apple hasn’t made it clear whether older links will be checked, if you have shared files or photos using public links in the past, go through them and stop sharing any you no longer need or switch them to “People You Choose.”
If you're sharing files with someone nearby or in your contacts, consider using AirDrop or Messages to send them directly without creating a sharing link.
In a nutshell, use the “Anyone with the Link” option only if you’re comfortable with anyone who has the link, including Apple, being able to access your content. For sensitive photos and files, we'd advise avoiding public links altogether.
Under pressure to better handle CSAM content on iCloud, Apple has announced a new policy that will allow it to scan publicly shared iCloud links for harmful content. However, there are a lot of unanswered questions, including what constitutes “harmful” content.
The way to avoid these checks is to not create public links unless you're comfortable with Apple inspecting the shared content. Use the “People You Choose” option while creating links, so that only people you approve can access your files.
Data removal service that covers 92–986 sites and re-scans every quarter to catch anything that reappears
Sends quarterly privacy reports showing what info was found, which brokers had your data, and how long each removal took
Includes email masking so you can share a stand-in address instead of your real one
/images/2023/12/05/aura-vs.-lifelock.png)
/images/2023/10/11/best-data-removal-service.png)
/images/2026/11/06/police_can_track_your_phone_through_ads_in_weather_and_gaming_apps.png)
/images/2026/11/06/apple-icloud-public-link-scanning.jpeg)
/images/2026/11/05/ford-data-privacy-connected-features.jpeg)
/images/2026/11/05/gm_told_370000_drivers_they_werent_tracked._they_actually_were_1.png)
/images/2026/11/04/bank-of-america-ai-agent-liability.jpeg)
/images/2026/10/29/no_price_posted__target_shopper_questions_missing_prices_on_tags._are__FG8eh28.png)
/authors/krishi_chowdhary_headshot.jpg){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2023/10/11/logo-deleteme-700px.png){kind=logo}
/authors/krishi_chowdhary_headshot.jpg)