iOS 27.3: Apple will check iCloud "Anyone with the link" shares for harmful content

Apple has told users that, starting with version 27.3 of iOS, iPadOS, macOS and visionOS, anything shared from iCloud with the "Anyone with the link" option will be "checked by Apple for harmful content". The notice sits on a new Apple support page dated 3 November 2026, the same day the first iOS 27.3 developer betas arrived. It does not say what counts as harmful or how the checking works, and it confirms that a link share is no longer end-to-end encrypted, even for people who turned on Advanced Data Protection.

Key points

• Apple's support page says items shared with "Anyone with the link" in version 27.3 or later of iOS, iPadOS, macOS and visionOS "will be checked by Apple for harmful content".
• Such a shared item "is no longer end-to-end encrypted", even if the owner has Advanced Data Protection switched on.
• If Apple flags content it "reserves the right to move, refuse, modify, remove, or delete" it, may block or disable the Apple Account, and may involve law enforcement.
• The first iOS 27.3 betas went to developers on 3 November 2026; The Verge reports Apple plans to release iOS 27.3 in December.
• The page does not define "harmful content" or explain the method, human or automated, and Apple did not answer The Register's questions.

What to do

• Know which kind of share you use. Apple's page describes two choices when you "Share a Link" to an iCloud photo or file: "People you choose", for people you invite or approve, and "Anyone with the link", for anyone who has the URL, "including Apple". The new checks apply to the second kind.
• Review old public links before 27.3 arrives. Anything you have shared with "Anyone with the link" is the content in question. If a link no longer needs to be public, stop sharing it or move it to named people. Apple's page does not say whether links created before the update will also be checked, so treat them as in scope.
• Prefer named sharing for sensitive files. Per Apple, a link share removes end-to-end encryption for that item. Sharing with "People you choose" or using "Send a Copy" are the other options on Apple's page; the page ties the new checks only to "Anyone with the link".
• No action is needed to "turn it on". It arrives with the 27.3 updates; there is no setting mentioned on the page.

What happened

On Tuesday 3 November Apple published a support article titled "Learn more about sharing content that can be accessed by Anyone with the Link". It was picked up on 4 November by 9to5Mac, The Verge and The Register.

The text is short. It says that when you share an item that can be accessed by Anyone with the Link in version 27.3 or later of iOS, iPadOS, macOS and visionOS, "that content is made accessible to Apple to check for harmful content". It then lists consequences: Apple may move, refuse, modify, remove or delete the content, and may block or disable the Apple Account, block the creation of a new account with the same email address or phone number, or, "if necessary", involve law enforcement. It adds that not all features are available in all countries or regions.

The page also explains the encryption trade-off. To make a public link work, the item is "no longer end-to-end encrypted", and Apple says this holds even when Advanced Data Protection is on. That is Apple's optional end-to-end encryption setting for iCloud.

The Register's reading is that, based on the wording, the checks seem to apply to every item shared with "Anyone with the link". The outlet also notes that Apple has not defined "harmful content", has not said whether people, software or both will review items, and did not respond to questions. The Verge adds that the move follows calls from protesters for Apple to crack down on child sexual abuse material (CSAM) stored in iCloud; Apple's page itself does not mention CSAM or give any reason.

Background

This is not Apple's first attempt at checking iCloud content. In 2021 it announced child safety features that included detecting known CSAM in iCloud Photos. After heavy privacy criticism, Apple put the plan on hold, and on 7 December 2022 it confirmed to The Wall Street Journal, in an interview with its vice president of software engineering, Craig Federighi, that it had stopped the plan. 9to5Mac noted that this came on the same day Apple announced Advanced Data Protection, which added end-to-end encryption for iCloud data.

The 27.3 change looks different in scope. It concerns items a user chooses to make public by link, which Apple's page says are accessible to anyone with the link, including Apple, and it turns that access into a check. Apple's page does not mention the 2021 plan. We do not know whether it uses matching against known material, machine-learning classifiers or human review, and we are not inferring one from the wording.

You can see where the new rule sits by comparing the three ways to share:

Way to share	Who can open it	Apple's page says
People you choose	Only invited or approved people	Not named in the new checks
Send a Copy	The recipient	Not named in the new checks
Anyone with the link	Anyone with the URL, including Apple	Checked for harmful content from version 27.3; no end-to-end encryption

What it means

For most users nothing changes unless they publish iCloud links. People who share family photos or documents by public link now know that Apple may look at them and may act on its decision, including on the account. Apple's page says it may block or disable the whole Apple Account, which is a heavy consequence for one flagged file, and the page we read describes no appeal route.

For developers and teams who use iCloud links to hand out files, the main point is that a public iCloud link is not a private channel and, from 27.3, is not a neutral one either. Sensitive material belongs in a private share or an encrypted container you control.

For privacy advocates, the line between "public" and "private" is drawn clearly by Apple's own page: link shares fall outside end-to-end encryption, while the rest of Advanced Data Protection is unchanged by this notice. The Register's criticism centres on the undefined term. The notice leaves the details open; we have no evidence of misuse.

If you test the 27.3 betas, our look at what Safari 27.3 adds covers another change in the same release.

What we don't know yet

• What "harmful content" means beyond the general idea. Apple has not defined it.
• How checking works, and whether people or software make the call.
• Whether links created before 27.3 will be checked, and whether links made on older OS versions count when opened or stored later.
• Whether there is an appeal route if content is removed or an account is disabled.
• Whether the policy differs by country; the page says features may not be available everywhere.
• The exact release date. The Verge reports December; Apple has given no day.

What to watch next

Look for Apple's reply to questions from The Register and others, a fuller description of the process in the iOS 27.3 release notes or Apple's legal terms, any transparency report figures once checks begin, and reactions from privacy groups. If the beta behaviour differs from the support page, we will add an update.

Sources

• Apple Support: Learn more about sharing content that can be accessed by Anyone with the Link (3 November 2026)
• 9to5Mac: With iOS 27.3, Apple will start checking iCloud public links for harmful content
• The Verge: Apple will check shared iCloud links for harmful content
• The Register: Apple turns iCloud into spy cloud, will start looking at public share links
• 9to5Mac (2022): Apple confirms that it has stopped plans to roll out CSAM detection system