Anyone who shares an iCloud photo or file through a public link will soon face a content check for harmful material. Apple’s policy starts with iOS 27.3, and the same change applies to iPadOS 27.3, macOS 27.3 and visionOS 27.3, according to AppleInsider.

Apple published the details in a support document on Tuesday, November 3, 2026. The first 27.3 beta is already out, and public rollout is reported for later this December, so US iPhone, iPad and Mac owners should expect the change within weeks. The check begins once people install the 27.3 update.

The scope is narrow on paper. The check covers items shared with “Anyone with the Link,” including iCloud Photos images and iCloud Drive files. It does not cover “People you choose” sharing, shared albums, or content that is simply uploaded to iCloud.

Two groups are affected. The first is anyone who uses public links to share from an iPhone, iPad or Mac. The second is anyone who receives those links, because a recipient can open content that Apple may review. Families who use links for shared photo collections fall into the first group, even if they never think of themselves as publishing anything.

Coverage has not been uniform. TechRepublic reports that Apple is not announcing checks of every private photo or file in iCloud. Cybersecurity News ran a broader headline, “Apple to Scan for Every Photo and File Shared Through a Public iCloud Link.” The qualifier at the end of that headline is the part that matters most.

Advanced Data Protection normally keeps iCloud photos and files end-to-end encrypted, so even Apple cannot view them, according to Yahoo Tech. That promise is the main reason many people turn the feature on. The new policy creates an exception most users will not expect.

Apple’s support document states that sharing through a public link disables end-to-end encryption, even when Advanced Data Protection is enabled. Turning on the feature does not keep a publicly shared file encrypted end to end, as TechRepublic notes. The setting protects your library. It does not protect a file after you publish a link to it.

For most people, this splits iCloud into two modes. Private content stays under the encryption model they were promised, while a public link becomes a different kind of object that Apple’s systems can access. A content check requires access to the file, so anything sent by public link should be treated as visible to Apple’s review process.

The encryption debate is not new. The UK government once pressed Apple for a backdoor to iCloud data, and it reportedly backed down last year after Trump administration intervention, according to Yahoo Tech. Apple’s public description limits the new checks to public links, but privacy advocates are likely to read the policy against that history.

What “harmful content” means, and what Apple has not said

Apple has not defined “harmful content” in its support document, and it has not explained why it made the change. Inc. and TechTimes both built their coverage around that gap.

Several questions remain open:

  • What counts as harmful content, and how is it detected? Apple has not said whether checks are automated or human.
  • Will links created before iOS 27.3 be checked? Apple has not answered.
  • Will the policy expand beyond public links? Apple says not for now, but the policy is new.
  • When will the 27.3 updates reach everyone? The beta is out, but reporting points to December.

The gaps matter because they give users no way to predict what will get flagged. A photographer who posts a public portfolio folder and a parent who shares a family album through a link face the same policy, with the same undefined standard. That is why privacy advocates keep asking what Apple considers harmful and whether it can see their files.

What Apple can do to flagged content and accounts

The support document gives Apple wide latitude. As 9to5Mac quoted it, Apple “reserves the right to move, refuse, modify, remove, or delete the content at any time.” Apple can also disable accounts, block replacement accounts tied to the same contact details, or contact law enforcement, according to AppleInsider and Yahoo Tech.

The penalty list goes well beyond what most people expect from a sharing setting. Losing an Apple Account can cut off access to iCloud and the devices tied to it, which is a far bigger consequence than a removed photo. Users who share content Apple flags could face that outcome, so creating a public link now carries account risk.

Who gains and who loses is fairly clear. Apple gains a defined position over content it hosts on public links. Users who rely on public links for casual sharing lose the assumption that those files are private. Recipients gain no new control over whether a link they receive gets checked.

You can reduce your exposure before the update reaches your devices. None of these steps requires waiting for the December rollout.

  • Review every public link you have created. Open the shared albums, photos and files you have sent and check whether “Anyone with the Link” is active.
  • Turn off “Anyone with the Link” for anything personal or sensitive, including identification documents and private family photos.
  • Use “People you choose” when you share with specific people, since that option sits outside the reported scope.
  • Send a copy instead of a link when the material is private and you do not need an ongoing connection to it.
  • Assume that anything shared by public link is not end-to-end encrypted, and assume Apple’s review process can reach it.

Do not assume older links are exempt. Apple has not said whether links created before version 27.3 will be checked, so the safest move is to audit them now rather than after the update lands.

What to watch before the December rollout

Three developments will shape how this policy lands. The first is the final release date. The 27.3 beta is already out, but reporting points to a December public rollout, and that timing gives users a short window to review their links.

The second is definition. If Apple publishes what counts as harmful content and explains whether detection is automated or human, users can judge the policy on its specifics. Until then, the policy rests on the company’s discretion.

The third is scope. Apple says the checks will not expand beyond public links for now. A new policy can change, and any expansion would move the debate from shared links to the wider iCloud library. Watch Apple’s support pages and the 27.3 release notes, because the company’s answers are most likely to appear there first.