What is changing in iOS 27.3?
Apple has quietly added a new rule to how iCloud link sharing works. A support document published alongside the first iOS 27.3 developer betas says items shared with the “Anyone with the Link” option will be checked for harmful content. The same change applies to iPadOS 27.3, macOS 27.3 and visionOS 27.3.
The document covers photos stored in iCloud Photos and files stored in iCloud Drive. When a user chooses “Share a Link”, Apple offers two audience settings. One is “People you choose”, limited to people the owner invites or approves. The other is “Anyone with the link”, which makes the item reachable by anyone holding the URL, and Apple says that includes Apple itself.
From 27.3 onward, content shared through the public option is, in Apple's wording, “made accessible to Apple to check for harmful content”. The document does not explain what triggers a check, what tools Apple uses, or whether a person reviews flagged items.
The share options appear when a user selects an item and chooses Share. Apple offers “Send a Copy” or “Share a Link”, and link sharing can be limited to invited people or opened to anyone.
Apple seeded the first 27.3 developer betas in early November. MacRumors and The Verge both report that the public release is planned for December 2026. The support page carries a standard caveat that not all features are available in every country or region.
The change is easy to miss because it arrives inside a routine point release. Point updates usually bring interface tweaks and bug fixes. This one changes a permission model that millions of people use for photo albums, work files and family videos.
Is Apple scanning everyone's private iCloud photos?
No, not according to the document. The check applies only to items a user has chosen to publish through an unauthenticated link. Photos and files that stay in a private iCloud library, or that are shared with named people, are outside the scope of this particular policy.
The more consequential change concerns encryption. Apple states that when an item is shared with “Anyone with the Link”, it is “no longer end-to-end encrypted”, even if the owner or participants have turned on Advanced Data Protection. That is a notable carve-out, because Advanced Data Protection is the setting Apple sells as its strongest cloud security tier.
Apple's own guide to Advanced Data Protection says the feature protects “the majority of your iCloud data” with end-to-end encryption, adding that “no one else can access your end-to-end encrypted data, not even Apple”. Public link sharing is now an explicit exception to that promise.
There is some ambiguity about how new this encryption behavior is. 9to5Mac notes that a public link has always been reachable by anyone who holds it, “including Apple”, because the link is public by design. What is new is that Apple is now stating the encryption consequence in writing and pairing it with an active content check.
The document also leaves practical questions open. It does not say whether links created before a device updates to 27.3 will be checked. MacRumors flagged that omission directly. Nor does it describe any appeal route for a user whose file is removed or whose account is disabled.
Why is Apple making this change now?
The timing follows a bruising legal stretch for Apple over child sexual abuse material in iCloud. In July 2026, US District Judge Noël Wise dismissed a proposed class action known as Amy v. Apple. The suit was filed in the Northern District of California in December 2024 on behalf of a proposed class of 2,680 people.
The plaintiffs were two survivors identified in filings as Amy and Jessica. They argued that images of their abuse continued to circulate through Apple's cloud storage. Initial filings sought around $1.2 billion, and later filings put compensatory damages as high as $32.8 billion, according to The Next Web.
Wise dismissed the case with prejudice, meaning the plaintiffs cannot refile it. She found that the claims fell inside Section 230 of the Communications Decency Act, the 1996 law that shields online services from being treated as the publisher of user content. She also found no federal statute requiring Apple to build detection tools.
Her ruling was not a defense of Apple's choices. “Lawmakers can fix this problem,” she wrote, adding: “This Court cannot.” Eric Goldman, a law professor who analysed the order, noted that Wise described a potential loss of privacy for millions of people as the likely cost of any scanning mandate.
A second case is still live. West Virginia Attorney General JB McCuskey sued Apple in February 2026 in Mason County Circuit Court, and Apple has asked to move the matter to federal court. The state's complaint cited reporting figures that underline the criticism: in 2023, Apple made 267 reports to the National Center for Missing and Exploited Children. Google filed 1.47 million and Meta filed more than 30.6 million.
The ruling landed in a year when courts tested the edges of Section 230. The Next Web notes that two cases got around the shield by focusing on product design rather than user content. One produced a $375 million verdict against Meta in New Mexico. Another produced a smaller combined award against Meta and YouTube in California. Those outcomes matter because they suggest a route for claims that avoid describing a platform as a publisher.
Apple has not said publicly that the litigation prompted the new link checks. The company has also pointed to other tools, including Communication Safety in Messages, which warns children about sensitive images without scanning a user's whole library. Readers should treat the lawsuit as context for the timing, not as a confirmed cause.
What does Apple mean by 'harmful content'?
That is the central unanswered question. The support document uses the phrase repeatedly but never defines it. It does not list categories, provide examples, or link to a separate policy that does.
MacRumors suggests the term could cover malware, malicious files or child sexual abuse material, partly because Apple explicitly mentions law enforcement. That is an informed inference, not a statement from Apple. The company has not confirmed which categories fall inside the rule.
The enforcement language is broad. Apple says it “reserves the right to move, refuse, modify, remove, or delete” content at any time. It may also block or disable an Apple Account, block the creation of a new account tied to the same email address or phone number, or involve law enforcement if necessary.
For a user, the practical risk is not only a deleted file. An account action can cut off access to photos, backups, messages, subscriptions and device sign-in at the same time. The document describes no notice period, review process or independent appeal before those steps.
Undefined categories also create room for inconsistent enforcement. A genuinely harmful file and a legitimate document could both be flagged, and the user may never learn which rule was applied. That opacity is a familiar complaint about automated moderation systems, and it becomes sharper when the system sits inside a paid storage product.
How does this compare with Apple's abandoned 2021 CSAM plan?
Apple has been here before. In August 2021 it announced a child safety package that included NeuralHash, a system designed to match photos against a database of known abuse imagery before they reached iCloud Photos. The matching was meant to happen on the device, using cryptographic techniques intended to limit what Apple could see.
The Electronic Frontier Foundation responded that the design was a backdoor regardless of its safeguards. “Even a thoroughly documented, carefully thought-out, and narrowly-scoped backdoor is still a backdoor,” the group wrote at the time. EFF also warned that scanning infrastructure built for one purpose could later be widened to others.
EFF's description of the planned system shows how much machinery was involved. A version of the NCMEC database would have shipped inside every iPhone, with images transformed so users could not view them. Matching would have happened on the device, and Apple would have learned of a match only after a preset threshold was crossed. Flagged photos would then have gone to human reviewers, and confirmed cases would have been reported to NCMEC with the account disabled.
Apple delayed the feature within weeks and abandoned it in December 2022. The reversal became part of the background to Amy v. Apple, whose plaintiffs argued that Apple had built a detection system and then shelved it.
The 2026 policy differs in an important respect. NeuralHash would have examined private photos inside a user's library. The new checks apply to items a user has deliberately published through a public URL, which weakens the privacy argument against them.
The structural concern is similar, though. A checking system now exists inside iCloud, and its scope is set by policy rather than by architecture. Expanding it to private items or to named-recipient shares would require a product decision, not a new capability. Apple has not suggested it intends to do that, but the document does not rule it out either.
Who is affected, and what can users do?
Anyone who updates to 27.3 and shares iCloud content through a public link is affected. That includes people who send large video files to friends, photographers delivering galleries to clients, and families circulating albums. It also includes users who enabled Advanced Data Protection expecting that public links inherited the same protection as the rest of their data.
There are two straightforward alternatives in the sharing sheet. “Send a Copy” transfers a file directly rather than publishing a link. “People you choose” limits access to invited or approved recipients. Apple's document places both outside the new check, so they remain the safer route for sensitive material.
Users should also assume that links already in circulation may fall under the rule once their devices update. Apple has not clarified the treatment of older links, so the cautious approach is to stop relying on public links for anything private.
Recipients are affected too, though indirectly. A public link is open to anyone who holds the URL, with no invitation or approval step, which makes it popular for one-off deliveries. If Apple removes an item, the recipient sees a broken link. The document addresses the owner's account, so a recipient has no stated route to challenge a removal.
Organisations face a harder task. Schools, clinics and small businesses often use public links because they are simple and work across devices. IT teams will need to decide whether that convenience is worth a content check with undefined criteria and account-level penalties. Managed Apple Accounts cannot enable Advanced Data Protection in the first place, which removes one layer of confusion but not the underlying risk.
What should we watch next?
The first checkpoint is December, when the 27.3 updates are expected to ship. By then Apple may publish more detail on detection methods, review procedures and the treatment of existing links. Absent that, users will be relying on inference from a short support page.
The second is the courts. The plaintiffs in Amy v. Apple were reviewing the dismissal and considering an appeal to the Ninth Circuit, their lawyers told CNN. The West Virginia case remains active, and its outcome could shape how much pressure other cloud providers feel.
The third is legislation. The European Union's Child Sexual Abuse Regulation has spent four years in negotiation over whether platforms can be compelled to scan private messages. Any agreement there would set a benchmark that extends well beyond Europe, and it could make Apple's current approach look either cautious or overdue.
The fourth is competitive behaviour. Google and Meta already file millions of abuse reports each year, and Microsoft's PhotoDNA is a long-standing industry tool. That contrast is part of why Apple's lower reporting numbers drew scrutiny. If Apple's public-link checks produce a visible rise in reports, the question will shift from whether scanning is acceptable to how accurately it works.
For now, the safest reading is narrow. Apple has not announced a general scan of private iCloud libraries. It has announced checks on content that users publish to the open web, paired with a clear statement that those links are not end-to-end encrypted. That is a real change, and it deserves more scrutiny than a footnote in a point release.