By default, Apple protects iCloud data using standard encryption, where certain data categories (like passwords, Health data, and payment information) are end-to-end encrypted, but other services—including iCloud Device Backups, Photos, Notes, and Drive files—retain decryption keys managed on Apple servers. While this enables Apple to assist users with account recovery, it leaves cloud storage vulnerable to server data breaches and governmental subpoenas. In iOS 18, Advanced Data Protection (ADP) enables complete end-to-end encryption across nearly all iCloud data categories, ensuring only your trusted devices possess the cryptographic keys.
Understanding What Advanced Data Protection Encrypts
When Advanced Data Protection is activated, the number of end-to-end encrypted iCloud data categories expands from 14 to 23:
- Newly Protected Categories: Full iCloud Device Backups, Messages Backups, iCloud Drive files, iCloud Photos, Notes, Reminders, Safari Bookmarks, Siri Shortcuts, Voice Memos, and Wallet Passes.
- Remaining Standard Encryption Categories: iCloud Mail, Contacts, and Calendar remain under standard server encryption because they must interoperate with global IMAP, CardDAV, and CalDAV protocols.
- Absolute User Sovereignty: Apple no longer holds the decryption keys. If you lose access to all your trusted devices and account credentials, Apple cannot decrypt or recover your data under any circumstances.
Configuring Mandatory Account Recovery Methods
Because Apple cannot restore an account locked out under ADP, iOS requires establishing at least one emergency recovery mechanism before enabling the feature:
- Open the Settings app on your iPhone running iOS 18.
- Tap your Apple Account profile banner at the top of the screen.
- Select Sign-In & Security, then choose Account Recovery.
- Configure one or both recovery alternatives:
- Recovery Contact: Select a trusted family member or colleague who also uses an Apple device. If locked out, they generate a six-digit verification code on their device to verify your identity.
- Recovery Key: Generates a 28-character alphanumeric cryptographic key. Print or record this key and store it in a physical fireproof vault or password manager.
Enabling Advanced Data Protection on iPhone
Once your recovery method is confirmed and active:
- Return to the main Apple Account menu in Settings and tap iCloud.
- Scroll down to the bottom of the screen and select Advanced Data Protection.
- Tap Turn On Advanced Data Protection.
- Review the security requirements. If you have legacy Apple devices connected to your Apple Account that do not support modern OS versions (iOS 16.2+, macOS 13.1+, watchOS 9.2+), you will be prompted to remove them before proceeding.
- Enter your 28-character Recovery Key (or confirm your Recovery Contact) to prove readiness.
- Enter your iPhone passcode to authenticate.
- Advanced Data Protection activates immediately across all devices linked to your Apple Account.
Managing Web Access to iCloud Data
Because end-to-end encryption restricts decryption keys strictly to physical devices, accessing iCloud.com from a web browser requires special authorization:
- By default, web access to Photos, Drive, and Notes is disabled when ADP is active.
- To allow temporary browser sessions: in Settings > [Your Name] > iCloud, toggle Access iCloud Data on the Web to On.
- When signing into iCloud.com on a computer, your iPhone will display an explicit authorization prompt to momentarily forward decryption keys for that specific browser session.