Apple iCloud

Is iCloud safe?

Yes, and with one setting it is the most private mainstream cloud we score. Apple end-to-end encrypts 15 categories of data for every account, including saved passwords, Health records and Messages in iCloud. Turn on Advanced Data Protection and that rises to 25, covering photos, iCloud Drive and full device backups, so Apple itself cannot read them. The catch is that the default is weaker: without that setting, Apple holds the keys to your photo library and backups. We score iCloud 75/100, ahead of Google Drive (70) and Google Photos (62), and behind Proton Mail (85), where zero-access encryption is the default.

What is end-to-end encrypted, feature by feature

Apple publishes a full table, and it is worth reading rather than trusting the word "encrypted" on its own. Everything in iCloud is encrypted in transit and on Apple's servers. What changes is who holds the key.

The Messages row is the one people miss. Messages are end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, but with iCloud Backup on and standard protection, the backup holds a copy of the Messages key, and Apple holds the key to the backup. Advanced Data Protection closes that gap.

Even with it on, some things stay readable to Apple. Shared Albums, iWork collaboration and anything shared with "anyone with the link" fall back to Apple-held keys. File names, checksums, dates and file sizes in iCloud Drive and Photos are encrypted under Apple's keys too, so Apple can de-duplicate storage. iCloud.com web access is switched off by default when ADP is on, and turning it back on gives the browser temporary keys.

The UK withdrawal

In 2025 Apple stopped offering Advanced Data Protection to new users in the United Kingdom. The UK Home Office had served a Technical Capability Notice under the Investigatory Powers Act demanding access to encrypted iCloud data, and Apple said it would not build "a backdoor or master key". UK users who never turned ADP on now get standard protection for backups, Drive, Photos, Notes and six other categories, with no way to change it; existing users were told they would have to turn the feature off themselves to keep using iCloud. The 15 default categories, iMessage and FaceTime remain end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary in the UK.

The dispute has not ended. According to Malwarebytes, citing The Guardian, the Home Office issued a narrower notice covering only British users, and Apple filed a new complaint with the Investigatory Powers Tribunal in 2026. The terms of the notice are secret. If you live in the UK, treat your iCloud photos and backups as readable to Apple and, through it, to UK authorities with a warrant.

Ads, scanning and children

Apple's ad platform runs in the App Store, Apple News, Stocks, Maps and the TV app. Apple says it does not track you across other companies' apps and does not use Health or Apple Pay data; iCloud content is not among the inputs it lists. That is a real difference from Google, where Photos data appears under third-party advertising on the App Store label.

The flip side of privacy is detection. Apple dropped a plan to scan iCloud Photos for known child abuse images in 2022. West Virginia's attorney general sued Apple in February 2026, alleging that iCloud has been used to store and spread such material and that Apple filed only 267 reports to the US National Center for Missing and Exploited Children in 2023, against 1.47 million from Google. These are allegations in a pending case. Apple told CNBC that protecting users, "especially children, is central to what we do", and pointed to parental controls and Communication Safety, which intervenes on children's devices when nudity is detected in Messages, shared Photos, AirDrop and FaceTime calls.

For ordinary users the content risk is small. There is no feed and no stranger can message you through iCloud. The exposure is Shared Albums sent by web link, which the iCloud terms say are public to anyone who has the link.

How to set up iCloud safely

1. Turn on Advanced Data Protection if you are outside the UK. You need two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary, all your devices on current software and a recovery contact or recovery key.
2. Store the recovery key on paper, away from your devices. Apple cannot restore an ADP account without it.
3. Add physical security keys to your Apple Account if you are a likely phishing target.
4. Use Shared Library or shared folders with named people instead of public links for family photos.
5. Back up important photos somewhere else as well. Apple may delete the iCloud Backup of a device that has not backed up for 180 days.

How we scored it

Security (82) is the strongest factor: broad end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary by default, an optional mode that covers nearly everything, and a bug bounty of up to $1 million for iCloud data access. Privacy (74) is held back because the default leaves photos and backups under Apple's keys. Scams and harmful content (66) and the regulatory record (65) reflect the pending West Virginia suit over child abuse material.