Yes, iCloud is encrypted, but by default Apple holds the keys to your iCloud Backup, Photos and iCloud Drive, so it can read them. Whether your data is private from Apple depends on one setting most people never touch: Advanced Data Protection. iCloud encrypts data in transit and at rest. By default, under what Apple calls Standard Data Protection, several important categories are encrypted with keys Apple holds, so Apple can access them. Turning on Advanced Data Protection makes most categories end-to-end encrypted, so Apple cannot. This page explains the difference, what each mode does and does not cover, and where a cross-platform zero-knowledge tool fits instead.
Standard vs Advanced Data Protection
This is the distinction that actually answers the question.
Standard Data Protection is the default. A set of especially sensitive categories — such as passwords and Keychain, and Health data — are end-to-end encrypted even here, meaning only your devices hold the keys. But other major categories, including iCloud Backup, Photos, and iCloud Drive, are encrypted with keys Apple also holds. For those, Apple is able to access the data and can produce it in response to a valid legal request.
Advanced Data Protection (ADP) is opt-in, introduced in December 2022. When you enable it, end-to-end encryption extends to most remaining categories — the keys move to your devices and Apple can no longer read that data. It is off unless you turn it on, which is why most accounts run under Standard Data Protection. To enable it on an iPhone: Settings, your name, iCloud, Advanced Data Protection. Apple asks you to set up a recovery contact or recovery key first, because it can no longer recover the data for you.
The UK exception. Since February 2025 Apple has not offered Advanced Data Protection to new users in the United Kingdom, and it has asked existing UK users to turn it off. For UK accounts, iCloud Backup, Drive, Photos, Notes and the other ADP categories stay under Standard Data Protection, with keys Apple holds; the 15 categories that are end-to-end encrypted by default are unaffected.
What ADP covers — and what it does not
Advanced Data Protection is a genuine, strong upgrade, but it is not total. Even with ADP enabled, three categories stay outside end-to-end encryption for interoperability reasons: iCloud Mail, Contacts, and Calendar. Mail has to be deliverable to and from non-Apple systems; contacts and calendars rely on open standards that assume server access.
So the honest one-line answer is: with ADP on, most of your iCloud data — backups, photos, files, notes — is end-to-end encrypted and private from Apple; mail, contacts, and calendars are not. With ADP off, a broader set of categories is accessible to Apple.
Can Apple read your iCloud data?
It depends on the mode:
- Standard Data Protection: Apple can access categories like iCloud Backup, Photos, and Drive, because it holds keys for them.
- Advanced Data Protection: Apple cannot read the end-to-end encrypted categories; it retains access only to Mail, Contacts, and Calendar.
If provider-blind privacy matters to you, the practical takeaway is that iCloud can be close to zero-knowledge — but only if you have actively enabled ADP, and only outside those three categories.
Where a dedicated zero-knowledge tool differs
iCloud's end-to-end encryption is strongest inside the Apple ecosystem, on Apple devices. Two things pull people toward a dedicated storage tool instead.
The first is cross-platform reach. If your work spans Windows, Android, Linux, and the web, a tool built to be provider-blind everywhere — not primarily on Apple hardware — is a cleaner fit.
The second is default and verifiability. A dedicated zero-knowledge tool encrypts every file client-side by default, with no setting to find, and some publish their crypto so the claim can be checked rather than trusted. ShieldFive encrypts every file and its name on your device before upload, on every plan. It stores only ciphertext and never holds your keys. Web uploads default to post-quantum hybrid encryption (ML-KEM-1024 with XChaCha20-Poly1305), with AES-GCM as a fallback. The limits: ShieldFive serves the web app's code, so the guarantee holds for the code you are served; file sizes and timestamps are not encrypted; the crypto core is open source but the apps are not; and no external security audit has been completed. It works in any browser, with an Android app in testing; there is no iOS app yet. Proton Drive and Tresorit are cross-platform zero-knowledge options. The best zero-knowledge cloud storage comparison weighs them on jurisdiction, audits, and post-quantum protection.
This page reflects Apple's public documentation as of 4 October 2026 (iCloud data security overview, Advanced Data Protection in the UK) and will be updated as the product changes.