If you’ve put in the effort to secure your data on your computer, iPhone and other devices, you can already sleep better than most people. But there’s still a vector that could be out of your control: cloud data. To ensure you’re running the highest level of encryption between you and Apple’s iCloud servers, turn on Advanced Data Protection. However, the technology is also under scrutiny in the UK, which led Apple to temporarily turn off the feature for UK customers.
If you’re outside the UK and concerned about who can see your data, here’s how to turn ADP on and how it differs from the default iCloud encryption.
Why is ADP turned off for UK customers?
In February, Apple took the unusual step of turning off ADP for customers in the UK. The British government has reportedly demanded that Apple provide a method for law enforcement to access encrypted data as part of criminal investigations. But that creates a serious security problem, because this type of backdoor access can also be exploited by criminals or untrustworthy governments.
Since then, Apple has appealed the Home Office’s demand, and in April, a judge ruled that discussions between Apple and the UK government can’t be held in secret.
ADP can no longer be enabled for people in the UK; those currently using ADP will need to turn off the feature at a future date.
How does Advanced Data Protection work?
The key difference between ADP and how Apple encrypts data by default is how accessible your information is when stored on Apple’s servers.
In what Apple calls standard data protection, information sent between points, such as files stored on iCloud Drive and iCloud backups of your devices, is encrypted and transmitted securely. If someone intercepts that data between the two points, they’ll see only gibberish.
That data remains encrypted when stored on Apple’s servers so you can access it from other devices, for instance. However, Apple can still access the encryption keys to unscramble and read the data — and provide it to law enforcement following a legal request.
By contrast, when you enable Advanced Data Protection for iCloud, the data is end-to-end encrypted, meaning only your trusted devices possess the encryption keys to read it. The information remains encrypted on the servers, and not even Apple can access its contents. (Not all iCloud data can be end-to-end encrypted. Apple breaks out which types of information, such as iCloud Mail messages, remains covered by standard data protection even when ADP is turned on.)
The UK’s Investigatory Powers Act — the Snooper’s Charter — makes that inaccessibility illegal, which is why Apple is turning the feature off for UK customers.
Some services are end-to-end encrypted, regardless of the sensitivity of the data, such as passwords, information stored in the Health app, and payment information.
Make sure your account is set up for Advanced Data Protection
To set up ADP on your account, first make sure you’ve met all the prerequisites for the feature:
- Your Apple Account must use two-factor authentication.
- You must set up a recovery method in case you lose access to your account. That method can be a 28-character Recovery Key or a person you’ve designated as a Trusted Contact.
- Every device connected with your Apple Account must be able to run at least iOS 16.2, iPadOS 16.2, MacOS 13.1, WatchOS 9.2, TVOS 16.2, or a HomePod running version 16.0. For Windows computers, make sure iCloud for Windows is at version 14.1 or later. You’ll be warned during the ADP setup process if any of your devices don’t qualify. If any of those are too old or you can no longer access them, tap Remove Devices in Settings and delete them from your list.
Steps to set up Advanced Data Protection
To turn on ADP on an iPhone, iPad or Mac do the following:
1. Go to Settings > [Your Name] > iCloud. On a Mac, open System Settings > [Your Name] > iCloud.
2. Scroll down to Advanced Data Protection, which likely says Off, and tap that.
3. If there are any of the aforementioned impediments to setting up ADP, such as needing to update other devices on your account, you’ll review them on the next screen.
4. In the following screen, tap Review Recovery Options. You need to have a Recovery Key, Recovery Contact or both to ensure that you can get your data if you lose access to your iCloud account.
5. Enter your device’s passcode to finish.
Activating ADP on one device means it’s on for all your devices using the same Apple Account, so you only need to set it up once.
For more on securing your data and devices, see how to securely share a Wi-Fi password with Apple and Android devices and everything you need to know about Apple’s new Passwords app.