Apple to screen public iCloud links

A support page quietly published by Apple on Tuesday describes a change to how the company treats files and other items that iCloud users share openly. Beginning with version 27.3 of iOS, iPadOS, macOS, and visionOS, content distributed through public share links will be subject to scanning, according to reporting by The Register. The scope is narrow on paper and considerable in practice: it covers anything a user has chosen to expose to whoever holds the URL.

What Apple has not supplied is a definition. The company's help page describes the checks in a single line, and leaves the term at the center of the policy undefined.

Where the line is drawn

The distinction Apple draws is between two kinds of sharing. Content sent directly to specific people is outside the new policy. Content shared using the "Anyone with the Link" option is inside it, and according to the help page, those items will be examined by Apple.

The company's wording suggests the checks apply to all iCloud items distributed that way. Apple also states that it can access such items — a point that follows from how the sharing option works. Choosing to publish a link removes end-to-end encryption from the shared item, Apple says, even if Advanced Data Protection remains switched on for the account.

That last detail matters for anyone who assumed Apple's optional end-to-end encryption feature covered everything in their account. Advanced Data Protection may stay enabled, but the item itself is no longer protected once it is placed behind a public link.

The undefined 'harmful content'

Apple's help page says items shared using Anyone with the Link will be checked for harmful content, without explaining what falls into that category. The company has also not described how the checks will be carried out.

“Items shared using Anyone with the Link will be checked by Apple for harmful content,”

— Apple, in a support page published on Tuesday

The page goes on to state that if a user attempts to upload harmful content, Apple reserves the right to move, refuse, modify, remove, or delete that content at any time. The company adds that it may block or disable accounts associated with harmful content.

Apple also says it reserves the right to involve law enforcement when necessary. That reference points toward categories such as child sexual abuse material (CSAM), malware, and other potentially unlawful content, though the company has not confirmed the boundaries of its definition.

Whether human moderators, automated systems, or a combination of the two will handle the identification and removal of flagged material is likewise unaddressed. Neither has Apple said whether any of those decisions could be delegated to AI systems, which as The Register notes can be fooled into making a bad moderation call.

Who decides what gets removed

Without a published definition, the practical question of who determines what counts as harmful is left open. The help page assigns Apple the authority to act on content it judges to fall into that category, and to take action against the accounts that posted it.

The range of permitted responses is broad. Moving, refusing, modifying, removing, and deleting are all listed as options, alongside blocking or disabling an account. For a user whose files sit behind a public link, the policy offers no described process for contesting a decision.

The Register's coverage notes one scenario raised by the absence of a definition: if Apple were to align its moderation with the priorities of political figures in the Trump administration, content those figures find objectionable could be wiped out. That is a possibility drawn from the undefined scope rather than a documented instance.

Encryption caveat for link sharers

The removal of end-to-end encryption on publicly shared items is not a new capability so much as a property of the sharing model. A link that anyone can open cannot be protected end-to-end in the same way a message to a named recipient can.

What is new is Apple's explicit statement that it will examine those items. Users who relied on Advanced Data Protection as a blanket guarantee should note the company's clarification that the feature's protections do not extend to content placed behind an Anyone with the Link URL.

For accounts that mix private and public sharing, the practical exposure is limited to the items published by link. Direct shares to named recipients are excluded from the policy as described.

Beta now, general release in December

Version 27.3 of Apple's operating systems went to developers in beta on Tuesday, the same day the support page appeared. A general release is expected in December.

That timetable gives developers and, eventually, ordinary users a window in which the behavior can be observed before it reaches the full installed base. It also means the policy's practical details — how scanning is performed, what triggers enforcement, what happens to a flagged item — may become clearer only once the software ships.

Apple did not respond to questions for The Register's story, leaving the help page as the company's only public description of the change.

What the policy covers at a glance

• Version 27.3 of iOS, iPadOS, macOS, and visionOS is where the checks begin.
• The beta went to developers on Tuesday; general release is expected in December.
• Scope is limited to iCloud items shared using Anyone with the Link, not content shared directly with other people.
• Public link sharing removes end-to-end encryption from the item, even with Advanced Data Protection enabled on the account.
• Apple reserves the right to move, refuse, modify, remove, or delete flagged content, and to block or disable associated accounts.
• The company also reserves the right to involve law enforcement when necessary.

Why it matters for iCloud users

The immediate consequence for individuals and businesses is that a public iCloud link is no longer simply a convenience. It is a publication act that places the item under Apple's moderation authority, with the terms of that authority left vague. Anyone who has used Anyone with the Link to pass along documents, images, or other files to a wide audience should assume those items are now visible to the company in a way directly shared content is not.

For organizations, the practical takeaway is procedural. Staff who habitually generate open links for files — a common shortcut when email attachments fail or recipients are unknown — are operating under a policy whose enforcement criteria have not been published. Until Apple defines harmful content and explains whether humans or machines make the call, the safest assumption is that any publicly linked item could be reviewed, and potentially removed, without a described appeal path.

The larger question this raises is about trust in the boundary between private storage and public sharing. Apple has framed the change as moderation of openly accessible material, which is a defensible position. But an undefined standard, combined with unilateral authority to delete content and disable accounts, means the limits of that moderation rest on Apple's own judgment rather than on anything users can read in advance. Whether that proves acceptable will depend on details the company has so far declined to provide.