HushkeeperIs iCloud Photos private? What Apple can and can't see
Your photos in iCloud are encrypted, but by default Apple keeps a copy of the keys. Advanced Data Protection changes that, with a few exceptions most people never hear about. Here's what actually protects your library, and where it stops.
Updated
Short version. iCloud Photos is encrypted in transit and on Apple's servers, but under the default setting (Standard Data Protection) Apple holds the keys and can decrypt it. Turn on Advanced Data Protection (Settings → your name → iCloud) and Photos and iCloud Backup become end-to-end encrypted, so only your trusted devices hold the keys. Even then, Shared Albums and "anyone with the link" sharing are not end-to-end encrypted, and new users in the UK can't turn the feature on at all.
The two levels of iCloud protection
Apple offers two settings for iCloud data, and which one you're on decides who can read your photos.
- Standard Data Protection is the default. Your data is encrypted while it travels and while it's stored, but the keys are kept in Apple's data centers. That's what lets Apple help you restore a backup or get back into your account after you forget your password. It also means Apple is technically able to decrypt that data.
- Advanced Data Protection (ADP) is opt-in. It moves the keys for most of your iCloud data onto your trusted devices only. Apple says it doesn't have the keys needed to recover that data, so neither Apple nor anyone who gets into Apple's servers can read it.
Some data is end-to-end encrypted even on the standard setting: passwords and Keychain, Health, Journal and a dozen other categories. Photos is not one of them. Neither is iCloud Backup. Both only get end-to-end encryption once you turn on ADP.
| Data | Standard (default) | Advanced Data Protection |
|---|---|---|
| iCloud Photos | Apple holds the keys | End-to-end encrypted |
| iCloud Backup (incl. Messages backup) | Apple holds the keys | End-to-end encrypted |
| iCloud Drive, Notes, Voice Memos | Apple holds the keys | End-to-end encrypted |
| Passwords, Keychain, Health | End-to-end encrypted | End-to-end encrypted |
| Shared Albums in Photos | Not end-to-end encrypted | Not end-to-end encrypted |
| "Anyone with the link" shares | Not end-to-end encrypted | Not end-to-end encrypted |
| iCloud Mail, Contacts, Calendars | Not end-to-end encrypted | Not end-to-end encrypted |
Based on Apple's iCloud data security overview (see sources below), as of October 2026.
So, is iCloud Photos private?
It depends on who you're worried about.
- A stranger who steals Apple's server data: on the standard setting your photos are encrypted at rest, but the keys sit in the same company's data centers. With ADP, a server breach yields data nobody can open without your devices.
- A request to Apple for your data: with standard protection, Apple holds keys that can decrypt your photos. With ADP, it says it doesn't.
- Someone who knows your Apple Account password or your phone passcode: neither setting helps much. iCloud Photos syncs your library to every signed-in device, and anyone who can unlock one of them can scroll through it.
- Someone you shared an album with: encryption never stops the people you deliberately give access to.
In other words, ADP protects your photos from Apple's side of the cloud. It does nothing about the phone in your hand or the people around you.
How to turn on Advanced Data Protection
Before you start, you need two-factor authentication on your Apple Account, a passcode on your device, and every device signed in to your account updated to at least iOS 16.2, iPadOS 16.2, macOS 13.1 or the equivalent (Apple's page lists Apple Watch, Apple TV, HomePod and iCloud for Windows too). Older devices have to be updated or removed from your account. ADP isn't available for child accounts or Managed Apple Accounts.
- Update your iPhone to the latest iOS.
- Open Settings, tap your name, then tap iCloud.
- Scroll down and tap Advanced Data Protection, then Turn on Advanced Data Protection.
- Set up at least one recovery method when asked: a recovery contact (someone you trust who can give you a code but can't see your data) or a recovery key (a 28-character code you store yourself).
- Follow the remaining prompts. Turning it on from one device turns it on for your whole account.
Read this before you switch it on. With ADP, Apple can't reset your access to that data. If you lose your devices and forget your passcode, and you have no recovery contact or recovery key, your end-to-end encrypted data is gone. Write the recovery key down somewhere safe, not in a note on the same phone.
The gaps ADP doesn't close
Shared Albums and public links
This is the one that surprises people. Shared Albums in Photos, iWork collaboration and anything shared with "anyone with the link" are not supported by ADP. For those, the keys are uploaded to Apple, so a photo you post to a Shared Album is not end-to-end encrypted even if ADP is on for you and everyone in the album.
iCloud Shared Photo Library is different: it keeps end-to-end encryption, but only if every participant has ADP turned on. One family member on the standard setting is enough to lose it.
iCloud.com
With ADP on, web access to your data at iCloud.com is switched off by default. You can turn it back on, and a trusted device then hands the browser temporary access to the keys. Convenient, but it's one more door. If you don't use iCloud.com, leave it off.
Metadata
Some details about your data stay under standard protection even with ADP, for example modification dates, checksums and information about your devices and backups. Apple holds those keys. Your photos themselves are covered; facts about your files are partly not.
The UK
Apple stopped offering ADP to new users in the United Kingdom. If you're in the UK and hadn't already enabled it, iCloud Photos and iCloud Backup stay on standard protection. Apple says existing UK users will be given time to turn it off themselves.
The photo inside the file
Encryption protects a photo while it's stored. It doesn't strip what's written inside the file, such as the GPS location and camera details. When you share a photo outside iCloud, those travel with it. Our free photo metadata remover shows and removes them in your browser, and the guide on removing location from iPhone photos covers the settings side.
Where an encrypted vault fits in
ADP is worth turning on for almost everyone who can. But it protects your whole library from the cloud side, while most real privacy problems happen on the device: someone borrowing your phone, a partner who knows your passcode, a repair shop. For a smaller set of photos and documents you want kept separate, a vault that encrypts on the device adds a second layer that doesn't depend on your iCloud settings.
That's what Hushkeeper is built for. Files, thumbnails, names and folders are encrypted with AES-256-GCM on your iPhone, behind a pattern that is separate from your phone passcode. Its iCloud backup is free and on by default, and only ciphertext is uploaded, whether or not your account uses ADP; restoring on a new phone takes your recovery phrase. Photos you take inside the vault never land in your camera roll, so they never reach iCloud Photos or a Shared Album in the first place. Hushkeeper is coming soon to the App Store.
If you'd rather use what's built in, compare the options in how to hide photos on iPhone, and see why the Hidden album isn't encryption. Moving photos out of your library? Delete the originals properly so a copy doesn't linger in Recently Deleted.
Quick checklist
- Check whether ADP is on: Settings → your name → iCloud → Advanced Data Protection.
- Update or remove old devices, then turn it on and set up a recovery contact or recovery key.
- Leave iCloud.com web access off unless you need it.
- Don't put sensitive photos in Shared Albums or public links; they're never end-to-end encrypted.
- Using a Shared Library? Ask everyone in it to turn on ADP too.
- Strip location data before you share photos outside iCloud.
- Keep your most private photos in an on-device encrypted vault, apart from your main library.
Sources
Free tools for this
See and remove photo metadata
See what a photo reveals — GPS location, camera, date, AI and Content Credentials markers — and download a clean copy without re-encoding the image.
Blur faces and redact photos
Hide faces, names, card numbers and addresses in photos and screenshots with a solid box, pixelation or blur.
Keep reading
How to permanently delete photos from iPhone
Deleting a photo on iPhone doesn't erase it right away. Where copies hide (Recently Deleted, iCloud, backups, shared albums) and how to remove each one.
How to hide photos on iPhone
Four ways to hide photos on iPhone — the Hidden album, locked Notes, turning the Hidden album off, and an encrypted vault — and what each one actually protects against.
iPhone Hidden album vs Hushkeeper
The iPhone Hidden album is free and built in, but it is locked by your device passcode and syncs with iCloud Photos. Here is when it is enough and when an encrypted vault is better.