Apple to check 'Anyone with the link' iCloud shares for 'harmful content' starting with iOS 27.3

Apple has told users it will start checking iCloud items shared through open links for "harmful content." The change arrives with version 27.3 of iOS, iPadOS, macOS and visionOS.

The company laid it out in a support document published Nov. 3, 2026. The first 27.3 developer betas went out this week. Apple says the public release is planned for December.

What Apple says changes

When you share something stored in iCloud, such as a photo in iCloud Photos or a file in iCloud Drive, you choose between "Share a Link" and "Send a Copy." Share a Link has two settings: "People you choose," meaning only people you invite or approve, and "Anyone with the link."

Only the second setting is affected. Apple's document says: "When you share an item that can be accessed by Anyone with the Link in version 27.3 or later of iOS, iPadOS, macOS, and visionOS, that content is made accessible to Apple to check for harmful content."

"People you choose" and "Send a Copy" are not covered by the new check.

Apple also states that an item shared through an open link "is no longer end-to-end encrypted, even if the owner or participants have turned on Advanced Data Protection." The company says that is needed to facilitate the sharing.

What happens if something is flagged

Apple says it "reserves the right to move, refuse, modify, remove, or delete" harmful content at any time. It can also act against the account behind it: blocking or disabling the Apple Account, and blocking creation of a new account tied to the same email address or phone number.

The document adds that Apple may involve law enforcement "if necessary." It notes that not all features are available in all countries or regions, but does not say which markets get the checks first.

What Apple has not said

The document does not define "harmful content." Apple's reference to law enforcement points toward child sexual abuse material (CSAM), and malware is another possibility, but Apple has not spelled out either.

Apple has also not explained how the checks work, and it has not said whether links created before the 27.3 update will be reviewed.

Those gaps matter. A policy that lets a company delete files and permanently block someone from opening a new account is only as clear as its definitions. Apple's document sets no limits on what counts as harmful, and it describes no way to contest a decision.

The 2021 backdrop

This is not Apple's first attempt at content checks. Its earlier plan would have scanned photos uploaded to iCloud against a database of known CSAM maintained by the National Center for Missing and Exploited Children.

Privacy advocates warned of a slippery slope. They argued the database could be swapped for other material, such as images of political dissidents, and used by oppressive governments. Apple dropped the plan, citing the risk of opening "new threat vectors for data thieves to find and exploit" and "a slippery slope of unintended consequences."

The new approach is narrower. It covers only items the user has chosen to make available to anyone holding a URL, and it does not touch private iCloud storage.

The case for the change

Apple's document says open-link content is "accessible to anyone who has the link, including Apple." That was already true before 27.3. Anyone with the URL could open the item in a browser, and Apple could technically do the same.

The argument that follows from that is simple. A company hosting publicly reachable files on its servers is choosing to look at what it hosts.

The change also follows pressure from child-safety advocates. The Verge reported that protesters have called on Apple to crack down on CSAM stored in iCloud.

What users can do

The practical choice is in the sharing menu. Anything sensitive can go through "People you choose" or "Send a Copy," both of which fall outside the new check.

The open question is how much discretion Apple gives itself. Between now and the December release, users and privacy advocates have no definition of "harmful content" to hold Apple to. Apple has also not said whether links created before 27.3 will be checked.