ProtonBlog(new window)

Apple can see much of what you store in iCloud

diese Seite teilen

Many people who use Apple products assume their data is private because of the company’s aggressive marketing on the topic.

“Some things shouldn’t be shared. iPhone helps keep it that way,” goes one famous ad(new window). “Privacy. That’s iPhone.”

But if you use iPhone and other Apple products, you probably also use the company’s cloud storage service, iCloud, to back up your photos, contacts, emails, calendars, notes, messages, voice memos, and other data. And iCloud is not private.

Apple can see everything you store in iCloud unless you update your security settings. And even if you turn on the new Advanced Data Protection feature, several important categories of data are not end-to-end encrypted(new window), including your emails, calendar events, contacts, and all your files’ metadata.

This article will help you understand Apple’s security model for iCloud and why its privacy-focused marketing does not reflect its product design. There are several gaps in Apple’s Advanced Data Protection feature you should know about. 

At the end of the article, we’ll provide some easy tips to help you improve your privacy and security if you use Apple products.

iCloud encryption model

Apple explains how it encrypts different types of data on its “iCloud data security overview(new window)” page. 

By default, Apple encrypts all your data in iCloud using its own keys, both in transit and on the company’s servers. This means your data is secure against third-party unauthorized access, but the company can see it. Apple calls this “standard data protection”.

In December 2022, Apple introduced new security features, including Advanced Data Protection, which applies end-to-end encryption to several additional kinds of data. Apple calls this their “highest level of cloud data security”. Advanced Data Protection generates encryption keys on each of your iCloud-connected devices and encrypts eligible data before uploading it to iCloud. Apple does not have access to the keys required to decrypt that data.

What is encrypted and how

Some kinds of data are always end-to-end encrypted, even with the default standard data protection:

  • Passwords and Keychain
  • Health data
  • Home data
  • Messages in iCloud (only when iCloud backup is disabled)
  • Payment information
  • Apple Card transactions
  • Maps
  • QuickType Keyboard learned vocabulary
  • Safari
  • Screen Time
  • Siri information (excluding Siri Shortcuts)
  • WiFi passwords
  • W1 and H1 Bluetooth keys
  • Memoji

If you turn on Advanced Data Protection, you’ll protect the following kinds of data with end-to-end encryption so that Apple can’t access them:

  • iCloud Backup (including device and Messages backup)
  • iCloud Drive
  • Photos
  • Notes
  • Reminders
  • Safari Bookmarks
  • Siri Shortcuts
  • Voice Memos
  • Wallet passes
  • Freeform

Limitations of Advanced Data Protection

These security benefits come with large caveats. The first is that three important kinds of data are never end-to-end encrypted:

  • iCloud Mail
  • Contacts
  • Calendars

Apple says it can’t encrypt this data because it wants these services to remain interoperable with other email and calendar providers. So no matter what you do, Apple will always be able to scan your communications, calendar events, and the personal details of people in your professional and social network.

Another limitation is that Apple doesn’t protect certain metadata with end-to-end encryption, even with Advanced Data Protection enabled. This includes: 

  • File type
  • File size
  • How many times a photo has been viewed
  • Whether a file was pinned or marked as favorite
  • Usage data, such as timestamps of when the file was created or last modified

Advanced Data Protection only works for file sharing and collaboration if the other parties also have end-to-end encryption enabled, and some tools and services never allow end-to-end encryption. 

Finally, Advanced Data Protection requires that all your iCloud-connected devices be updated to the latest software version. Otherwise, you must disconnect those devices from iCloud. This potential inconvenience, along with the additional friction of adding a recovery contact and a recovery key, are barriers to turning on end-to-end encryption.

Protect your fields with end-to-end encryption with Proton Drive

Protecting your privacy on Apple products

Apple is clearly not as private as the company would like you to believe. But compared with its top competitors, Apple products do offer a higher level of security and privacy. For example, the data on your iPhone is notoriously secure(new window) — as long as you don’t upload it to iCloud. 

Here are some additional tips to keep Apple out of your private life.

Turn on Advanced Data Protection

Even if there are significant limitations to Advanced Data Protection, it’s good to protect as much of your data as possible behind end-to-end encryption. Many people enjoy the convenience of iCloud, so if you’re going to continue using it, you may as well take advantage of Apple’s most powerful security settings. Just make sure to store your recovery key in a safe place, such as your password manager.

Don’t use Apple Mail, Calendar, or Contacts

Apple points to interoperability as the reason it can’t use strong encryption for its mail, calendar, and contacts services. But this isn’t persuasive. While it’s true you can’t use end-to-end encryption automatically with other non-PGP(new window) providers, Apple could still use a form of zero-access encryption(new window) to ensure that at least its own customers’ data is inaccessible to the company. For example, Proton Mail encrypts incoming emails instantly so that only you can decrypt them using your private key. 

Choose services that are end-to-end encrypted by default

Apple’s choice of the term “standard data protection” reveals how the company thinks about your right to data privacy. For Apple, having access to your personal information is the standard. We believe privacy should be the default, and we’ve built a set of online services to help you achieve it. 

For online cloud storage, Proton Drive secures your files with end-to-end encryption. Unlike Apple, we also secure most metadata with end-to-end encryption, including file name, file type, file size, and use data, such as creation and modification timestamps. The Proton Drive mobile app is available for iPhone(new window)

Additional end-to-end encrypted alternatives include Proton Mail(new window) (including encrypted contacts) and Proton Calendar(new window).

Schütze deine Privatsphäre mit Proton
Kostenloses Konto erstellen

diese Seite teilen

Ben Wolford(new window)

Ben Wolford is a writer and editor whose work has appeared in major newspapers and magazines around the world. Ben joined Proton in 2018 to help to explain technical concepts in privacy and make Proton products easy to use.

Verwandte Artikel

Can you password-protect a folder in Google Drive?
en
Protecting a folder with a password is a simple yet effective way of securing files. You may wonder whether you can password-protect a folder in Google Drive. We explain what access controls Google Drive offers and what you can do to improve your sec
Proton Pass now supports passkeys on all devices and plans
en
We’re excited to announce that Proton Pass supports passkeys for everyone, allowing you to manage and use passkeys across all devices seamlessly. Passkeys are an easy and secure alternative to traditional passwords that can help prevent phishing atta
what is a passkey?
en
  • Grundlagen der Privatsphäre
Passkeys are a new way to secure your online accounts using cryptographic keys instead of passwords. They offer a high level of convenience and security, and are a real game-changer in the way we access and secure sites. What is a passkey, though, an
en
Apple’s marketing team has built a powerful association between the iPhone and privacy. The company’s ad campaigns claim that “what happens on your iPhone, stays on your iPhone.” And, “Privacy. That’s iPhone.” But Apple’s lawyers are telling a diffe
en
A cyberattack on national public employment service France Travail has exposed the personal data of as many as 43 million people.  The latest breach is the second major cybersecurity attack to happen in France in the past month, raising concerns abo
If I share a folder in Google Drive, can anybody see my other folders
en
Google Drive makes it easy to share files and folders, but you may have wondered at some point whether the people you’ve shared a folder with can see your other folders. We answer this question below and also share some tips for truly secure link sha
en
In 2014, Proton Mail was introduced as a web app, revolutionizing how we think about email privacy. Today, we’re excited to broaden the horizons of secure communication by launching the Proton Mail desktop app. Anyone can now use the new Proton Mail