Apple will scan publicly shared iCloud links for harmful content in iOS 27.3

What Apple is changing

Apple will begin inspecting iCloud items shared through public links for material it considers harmful, starting with version 27.3 of its operating systems. According to The Verge, the change is described in an Apple support document that was first reported by 9to5Mac.

The policy covers anything shared using the "Anyone with the Link" permission on iOS, iPadOS, macOS and visionOS version 27.3 or later. Apple's document states that once an item is shared this way, the content becomes accessible to Apple for review. The Verge also highlights a consequential technical detail: sharing an item through a public link means it is no longer end-to-end encrypted.

What Apple can do with flagged material

Apple says it can "move, refuse, modify, remove, or delete" any upload it judges to be harmful. Enforcement does not stop at the file itself. According to the support document, the company may also block or disable accounts, prevent a user from opening a new one and, in cases it considers necessary, involve law enforcement.

An undefined term

Neither the support document nor the report defines what qualifies as harmful content, leaving the exact scope of the scanning unclear. The move does follow public pressure: The Verge reports that protesters have been calling on Apple to do more about child sexual abuse material stored in iCloud.

The change also lands against a longer history. Apple proposed scanning users' photo libraries for known child sexual abuse material in 2021 but abandoned the plan in 2023 after widespread privacy criticism. The new approach is narrower in one respect, since it applies only to items deliberately shared through public links rather than everything stored in iCloud. But it does something the earlier proposal did not: it strips shared items of end-to-end encryption and places Apple in the position of directly reviewing user content.

When it arrives

Apple has already released the first developer betas of the 27.3 updates, and the company has said it plans to release iOS 27.3 publicly in December, according to The Verge.

Why it matters

Link sharing is one of iCloud's most common conveniences: sending a large file, photo album or document to someone without managing per-user permissions. Under the new policy, that convenience comes with a trade-off most users will never see spelled out. The shared item can be read by Apple, and the encryption protections Apple markets heavily elsewhere effectively do not apply to it.

The undefined scope of "harmful content" is the other open question. Targeting child sexual abuse material has obvious public support, but a term with no published definition can expand quietly, and the policy gives Apple unilateral authority to delete material and terminate accounts. People who share sensitive but lawful files, including journalists, activists and researchers, may need to treat iCloud public links as public in a stronger sense than before.

The practical takeaway for technical readers: on the evidence of this document, private iCloud storage appears unaffected. The policy bites only when a link is opened to anyone who holds it. Anyone relying on iCloud link sharing for confidentiality should assume Apple can inspect the contents once iOS 27.3 ships in December.