Apple to check public iCloud links in iOS 27.3

Apple will check iCloud items shared with "Anyone with the Link" for harmful content starting in iOS 27.3, removing end-to-end encryption for those links—creators and operators should audit public link workflows now.

What happened

The Verge reported that Apple will start checking iCloud items shared with "Anyone with the Link" for "harmful content" starting with iOS 27.3 and other 27.3 updates across iPadOS, macOS, and visionOS. The change is detailed in an Apple support document reported on by 9to5Mac.

According to Apple: "When you share an item that can be accessed by Anyone with the Link in version 27.3 or later of iOS, iPadOS, macOS, and visionOS, that content is made accessible to Apple to check for harmful content." Sharing over iCloud with the "Anyone with the Link" permission will also mean that it is no longer end-to-end encrypted.

Apple's support document does not define what "harmful content" is. The company says it "reserves the right to move, refuse, modify, remove, or delete" any harmful content that a user attempts to upload. Apple may also block or disable accounts, prevent a user from making a new account, or, "if necessary," invoke law enforcement. Apple launched the first 27.3 developer betas yesterday and plans to launch iOS 27.3 in December.

Key facts

• Apple will check iCloud items shared with "Anyone with the Link" for "harmful content" starting with iOS 27.3 and other 27.3 updates.
• The change applies to iOS, iPadOS, macOS, and visionOS in version 27.3 or later.
• Items shared via "Anyone with the Link" will no longer be end-to-end encrypted.
• Apple can move, refuse, modify, remove, or delete harmful content, and may block or disable accounts or invoke law enforcement.
• Apple has not defined "harmful content" in its support document; the first 27.3 developer betas launched yesterday, with iOS 27.3 planned for December.

Our analysis

This is a privacy shift for anyone distributing files through public iCloud links. For creators and social media managers who send preview files, media kits, campaign assets, or community resources via "Anyone with the Link," the change likely means those transfers should no longer be treated as private or end-to-end encrypted. Apple's ability to inspect shared content is now explicit.

The lack of a definition for "harmful content" creates operational uncertainty. The support document follows calls from protestors for Apple to crack down on child sexual abuse material stored in iCloud, which suggests enforcement may focus on serious abuse content, but the policy language is broader. Because Apple can remove content, block accounts, or prevent new account creation, a public link that is flagged could disrupt a creator's entire iCloud account, not just a single file.

What is different from before is the combination of inspection and loss of end-to-end encryption for link-based sharing. Creators who relied on iCloud's privacy framing for client work may need to separate public distribution from confidential delivery. The timing is also near: iOS 27.3 is planned for December, and developer betas already exist.

What it means for operators

• Audit existing public iCloud links: Find any "Anyone with the Link" shares used for client assets, media kits, or community downloads, and document what they contain.
• Stop treating public iCloud links as encrypted or private: Because Apple can check these items and act on accounts, move confidential or sensitive client materials to a different delivery method before the 27.3 rollout.
• Review messaging to clients and communities: If you have promised end-to-end encryption or private file delivery via iCloud links, prepare an update explaining that public links on 27.3 or later are accessible to Apple for harmful content checks.
• Monitor Apple's support document for a definition of "harmful content" and any enforcement thresholds: Since the term is not currently defined, watch for updates as iOS 27.3 approaches in December.