Apple Scanning iCloud Links: What iOS 27.3 Really Checks

By Unes (@unespc) · · 7 min read

Apple scanning iCloud is real now, but it's way narrower than the scary headlines make it sound. Starting with iOS 27.3, anything you share from iCloud Photos or iCloud Drive with the "Anyone with the link" setting gets checked by Apple for "harmful content," according to a new Apple support page. Your private photo library isn't part of it, and neither is stuff you share with specific people. The catch is that Apple won't say what "harmful" actually means.

Most people don't have it yet. Apple shipped the first iOS 27.3 developer beta on November 3, the public beta followed on November 5, and the final release is expected in December, per MacRumors. So unless you're running the beta, you've got a few weeks to clean up your links.

What is Apple actually scanning in iOS 27.3?

Only public links. Apple's wording is short: "Items shared using Anyone with the Link will be checked by Apple for harmful content." That covers photos from iCloud Photos and files or folders from iCloud Drive, on iOS, iPadOS, macOS and visionOS 27.3 and later, so your Mac is in the same boat as your iPhone.

What's not included matters just as much. Sharing with "People you choose" isn't covered, which MacRumors and The Register both point out, and neither is the stuff that's just sitting in your iCloud. AppleInsider also says Shared Albums are out of scope, but Apple's page doesn't mention Shared Albums at all, and a Shared Album can be turned into a public website anyone can open. I'd treat that one as unclear.

So who does this actually hit? Mostly normal people. Dropping an iCloud folder link in a class group chat. Posting a video link in a Discord server. Sending full-quality clips to friends who aren't on iPhone. I daily drive a Galaxy Z Fold 8 Ultra, so I'm exactly who iPhone users end up sending these links to. That casual sharing is what's in scope, way more than anything shady.

Nope. And this is the part a lot of people miss.

Advanced Data Protection is Apple's opt-in end-to-end encryption for iCloud, the setting that means only your devices can read your stuff. But Apple's own iCloud data security overview says sharing with "anyone with the link" doesn't support it, because the keys for that content get uploaded to Apple's data centers so the link works on the web. Makes sense, honestly. A link anyone can open can't also be locked to your devices.

Same page, sneaky detail: the Shared Albums feature in Photos doesn't support Advanced Data Protection either. So if you thought turning on ADP made all your shared stuff private, it didn't.

Public links were already readable on Apple's side long before 27.3, and now Apple is going to start checking them.

What happens if Apple flags something you shared?

This part is heavier than I expected. Per the support page, as quoted by 9to5Mac and Inc., Apple "reserves the right to move, refuse, modify, remove, or delete the content at any time." It can also take action against your Apple Account and bring in law enforcement if it decides that's necessary.

AppleInsider adds a detail that honestly made me pause: Apple can disable the account and block replacement accounts tied to the same contact details. That's a big deal, because a disabled Apple Account can take your iCloud photos and backups down with it.

The Register notes Apple hasn't said whether a human or an automated system makes the call. MacRumors points out Apple also hasn't said whether links you made before 27.3 get checked too.

Is this Apple's 2021 photo scanning plan coming back?

Kind of, but I don't think it's fair to call it the same thing.

In 2021 Apple announced a system that would check photos for known child abuse material on your iPhone before they uploaded to iCloud Photos. The backlash was huge, and in December 2022 Apple dropped the plan completely. Its statement back then literally said "Children can be protected without companies combing through personal data."

That old plan was about your private library, checked on your own device. This new one is about content you've already chosen to make public, checked on Apple's side. Big difference.

And if you use Google or Microsoft, none of this is new to you. Google says it uses hash matching and AI to analyze the content of your Google Account for CSAM, which is way broader than public links. Microsoft says it runs PhotoDNA hash matching on images and video shared through its consumer services. Apple was the odd one out, and the numbers show it. West Virginia's lawsuit against Apple says Apple filed 267 reports with the National Center for Missing & Exploited Children in 2023, while Google filed 1.47 million, per CNN.

Apple hasn't said. So this part is my read, and I could be wrong.

West Virginia's attorney general sued Apple in February, accusing it of letting iCloud be used to store and spread child abuse material, and one thing the state wants is a court order requiring Apple to put real detection in place. A separate class action got thrown out in July, but the West Virginia case is still moving forward in state court. My guess is public links are the obvious first target: they're how files spread, and they were never encrypted, so Apple can check them without touching anyone's private library.

Most of the coverage skipped the actual steps, so here's what Apple's own help pages say.

iCloud Drive on iPhone or iPad: open the Files app, find the file or folder, touch and hold it, tap Manage Shared File (or Manage Shared Folder), then tap Stop Sharing (Apple's iPhone steps).

iCloud Drive on a Mac: in Finder, open the Shared folder in the iCloud section of the sidebar and group by Shared By to see everything you're sharing. Then Control-click an item, choose Manage Shared File or Manage Shared Folder, and click Stop Sharing, per Apple's Mac guide.

Photos iCloud Links: these clean themselves up. Apple says iCloud Links automatically expire after 30 days. If you want one gone sooner, go to iCloud.com/photos, click iCloud Links in the sidebar, pick the collection and choose Stop Sharing.

Heads up, per that same Mac guide: if someone already saved their own copy, stopping the share doesn't pull it back. For anything private, use "People you choose" instead.

So should you actually care about Apple scanning iCloud?

My take: the scope is fine, the vagueness is not.

Scanning public links is basically the industry minimum, and Inc.'s Jason Aten makes the fair point that once you share something with anyone who has the link, you can't expect much privacy anyway. Checking public links while leaving private libraries alone is a W, ngl, and way better than what Apple floated in 2021.

But "harmful content" with no definition, no word on whether a person ever looks at a flag, no appeal process I could find, and account bans on the table? That's an L. The Register flagged the vague wording and how it could get misused, and lowkey that's the part I'd watch. If nobody writes down where the line is, the line can move.

Practically, nothing changes for most people. Treat any iCloud link like you're posting it publicly, because now Apple will too.

So here's what I'm curious about: would you rather Apple spell out exactly what it's scanning for, even if that makes it easier for bad actors to dodge it?

FAQ

Is Apple scanning all my iCloud photos?

No. Apple's support page says the checks only apply to items shared with "Anyone with the Link" in version 27.3 and later. Your private library and stuff shared with specific people aren't included.

With the 27.3 updates. The betas came out November 3 and 5, and the final release is expected in December.

No. Apple says sharing with "anyone with the link" doesn't support Advanced Data Protection, because the keys for that content get uploaded to Apple so the link works on the web.

For iCloud Drive, touch and hold the item in the Files app, tap Manage Shared File or Manage Shared Folder, then Stop Sharing. Photos iCloud Links expire on their own after 30 days, or you can stop them early from iCloud.com/photos.

What does Apple count as harmful content?

Apple hasn't said. MacRumors figures child abuse material and malware, since Apple mentions law enforcement, but that's a guess, not Apple's definition.

I do quick breakdowns like this on Instagram and YouTube, so follow there for the video version, and come argue about this one in the Discord. More posts like this live on the blog, and if you're on a Windows PC, FixKon is the app I built to keep it running clean.