Mac Security · High-Risk Users & Lockdown Mode · Lesson 3 of 5

Advanced Data Protection for iCloud

End-to-end encryption for most iCloud data, and the recovery it needs.

What gets end-to-end encrypted

Encryption scrambles data so only someone with the right key, a secret code, can read it. End-to-end encryption means only your own devices hold the keys. Even the company storing the data can't read it.

iCloud has two levels of protection:

• Standard data protection is the default. Some data, like passwords in Keychain and Health data, is already end-to-end encrypted. For most other data, Apple holds the keys. That lets Apple help you get your data back if you lose access.
• Advanced Data Protection is optional. Your trusted devices hold the only keys for most of your iCloud data, including iCloud Backup, Photos, Notes and iCloud Drive.

With Advanced Data Protection on, Apple doesn't have the keys. So Apple can't help you recover that data. You must have your own way back in.

That is why you set up at least one recovery method first:

• A recovery contact is a person you trust who can give you a code to help you get back in. They can't see your account or data.
• A recovery key is a 28-character code you write down and keep somewhere safe. With a trusted phone number and an Apple device, it can get you back in.

You also need two-step sign-in (Apple calls it two-factor authentication) and up-to-date software on every device signed in to your account. An old device that can't update must be removed from your account first.

To turn it on, open the Apple menu and choose System Settings. Click your name, then iCloud. Click Advanced Data Protection, then Turn On, and follow the steps.

Treat your recovery method like a spare house key. If you lose it and your devices, no one can open the door for you.

What stays outside the lock

Advanced Data Protection covers most of your iCloud data, but not all of it. Knowing the gaps helps you decide what to store where.

These stay under standard protection, where Apple holds the keys:

• iCloud Mail. Email has to work with every other email system in the world, so it can't be end-to-end encrypted this way.
• Contacts and Calendars. They use shared standards so they work with other apps, and those standards don't support end-to-end encryption.
• Metadata. Metadata is information about your data, not the data itself. Examples are backup dates, device names, and file sizes and dates.

Sharing has limits too:

• Shared items stay end-to-end encrypted only if everyone in the share also has Advanced Data Protection on.
• A few kinds of sharing are never end-to-end encrypted: working together in Pages, Numbers or Keynote, Shared Albums in Photos, and anything shared with anyone with the link. Think before you share.

The iCloud website changes too. With Advanced Data Protection on, using your data at iCloud.com is turned off at first. You can turn it on, and your device then shares the keys with the browser for a short time.

It is not offered everywhere. For example, Apple stopped offering it to new users in the United Kingdom in 2025.

A practical rule: if something is truly sensitive, don't keep it in email, contacts or calendar notes. Keep it in an app that is end-to-end encrypted, like Notes, with Advanced Data Protection on.