iCloud is Apple’s cloud-storage and synchronization service. Holds device backups, photos, messages, contacts, calendars, notes, browser history, keychain, and increasingly home and health data. Default-on for any user who signs in with an Apple ID. Around 1 billion users worldwide. Historically held the encryption keys server-side (Apple could read most categories under court order); since Advanced Data Protection (December 2022), users can opt into end-to-end encryption for most categories.
What it means in practice
The encryption story has two regimes. Standard iCloud (default): around 14 categories are encrypted in transit and at rest with Apple-held keys, meaning Apple can decrypt and produce on warrant. The exceptions (always E2EE) are Keychain, Health, and a few others. Advanced Data Protection (opt-in): expands E2EE to iCloud Backup, Photos, Notes, Reminders, Safari Bookmarks, Voice Memos, Wallet Passes, plus everything previously E2EE. Apple loses the ability to decrypt; the user gets recovery responsibility (a recovery contact and/or a recovery key, lose both and the data is unrecoverable). The 2025 UK Technical Capability Notice forced Apple to remove ADP for UK users; the Apple-government dispute over global ADP availability remains open and is the most consequential ongoing fight over end-to-end encryption at consumer scale.
Where it shows up
Affects: every iPhone, iPad, Mac, and Apple Watch user signed into an Apple ID. The categories that were historically subpoena-producible (Photos, Notes, Backup) are now ADP-protectable for users who enable it. The categories still subpoena-producible regardless of ADP: iCloud Mail (because email needs to talk to non-Apple servers), Calendars and Contacts when shared with non-Apple users, anything you have shared via shared albums or shared notes. For a journalist, lawyer, or NGO operator: the ADP toggle is one of the highest-leverage privacy settings on iOS, and the asymmetry between ADP-enabled and ADP-disabled is enormous in terms of what Apple can produce under legal process.
What you can change today
Enable Advanced Data Protection now if you have not. Settings, Apple ID (top of Settings), iCloud, Advanced Data Protection, Turn On. The flow requires you to set up a recovery contact (a trusted person who can help you regain access) or a recovery key (a 28-character string you write down and store offline). Both are good; both is better. Walk through every device signed into the Apple ID and confirm each is updated to a recent enough OS to support ADP (iOS 16.2+, macOS 13.1+). Once enabled, audit what is in iCloud Backup (Settings, Apple ID, iCloud, iCloud Backup) and disable backup for any app where you would rather not retain history (a deleted Signal app whose backup is restored later replays the entire conversation history).