Apple will check public iCloud links for harmful content, even with Advanced Data Protection on

The sharing menu can change who can read the file. Apple’s new support notice makes that boundary explicit: an iCloud item shared with anyone holding its link becomes accessible to Apple, including when Advanced Data Protection is enabled for the account.

The notice, published November 3, says harmful-content checks apply to this sharing option in version 27.3 or later of iOS, iPadOS, macOS and visionOS. That is a stated version threshold. It should not be read as a claim that every device already runs that release.

Apple distinguishes sending a copy from sharing a link. Within link sharing, there are choices for selected people or anyone with the link. Those options can look like different ways to get a file to the same colleague, but their audience boundaries differ substantially. The menu’s small print has a very large guest list.

The notice says the public-link item is “no longer end-to-end encrypted.” Its wording applies to that shared item. It does not say that turning on one public link decrypts the rest of a person’s private iCloud collection. Expanding the warning that far would create a different story unsupported by the document.

It also does not say content checks create the encryption exception for the first time. The account-level protection and the public-sharing exception are distinct parts of the explanation. A new notice about checking is insufficient evidence for a claim that public links previously had a stronger encryption guarantee.

For someone sharing a sensitive file, the useful pause happens before copying the link. Is the intended audience a specific set of people, or anyone who receives it? Forwarding becomes part of the access model when possession of the URL is enough. A guest pass that works for its photocopies has rather flexible attendance rules (very accommodating).

The document says People you choose limits access to people invited or approved. That describes the recipient restriction. This particular notice does not spell out every cryptographic condition for that option, so it cannot support a blanket promise about all possible private sharing arrangements.

Apple also describes possible action when content is flagged, including actions against content and an account. That is a statement of reserved powers, not evidence of a specific removal or an error rate. The page offers no measured false-positive rate, published detection mechanism or independent assessment of those checks.

An organization reviewing its own sharing guidance could use this moment to separate account settings from link settings. A policy that tells everyone to enable Advanced Data Protection without discussing public links leaves a substantial question unanswered. The name on the larger switch does not automatically describe every smaller switch beneath it.

Future scrutiny should follow the actual sharing behavior and the published scope of the checks. The support notice establishes the boundary; it leaves the implementation and the experience of contested flags largely unspecified. The file’s recipient list starts changing before the recipient opens it.

The link has company.