The change arrived as a paragraph on a support page, which is how Apple prefers to announce the things it expects to be argued about.
In an update dated November 3, the company said that beginning with iOS, iPadOS, macOS and visionOS 27.3, iCloud sharing links set to “anyone with the link” will be checked for harmful content. Apple reserves the right to move, refuse, modify or delete that content, and to disable the account that posted it. Where necessary, the company said, it will refer cases to law enforcement. The release entered developer testing this week and is expected to reach users in December.
What the page does not say is nearly as long as what it does. Apple did not explain whether the checks are performed by people or by models. It did not define harmful. It did not say what a user is told when a link stops working, or whether there is an appeal, or how long a review takes, or what evidence a person would need to present to get an account restored.
Those omissions are not incidental to the policy. They are the policy. A rule with an undefined trigger and an unstated process gives the operator maximum discretion and the user minimum notice, and Apple has chosen both.
The mechanics matter here. An iCloud link set to public is a URL that anyone holding it can open, which is why people use it to send a photo album to a group chat or a folder of documents to a colleague. It is also, by design, not private. The company is not proposing to read files sitting in a user’s account. It is proposing to inspect what a user has deliberately published, which is the least controversial place to start and the place where a company’s standards become visible.
Apple has been here before. In 2021 it announced a system that would scan photographs on a user’s device for known images of child sexual abuse before they were uploaded, and it withdrew the plan after a campaign from security researchers and privacy groups who argued that a scanner built for one purpose would be repurposed for others. The objection then was architectural: the check ran on the phone, against a database the company controlled, and the same machinery could be pointed at anything.
The new check is narrower on its face. It applies to published links, not private libraries, and it appears to run on content already stored in the company’s data centers, where Apple has always had the technical ability to look at what it hosts. The company can argue, with some force, that a public link is a publication and that hosting a publication carries obligations.
The argument that will not be settled by that reasoning is about language. Harmful is a word with no agreed boundary. It can mean illegal, and in most jurisdictions the categories are specific: images of abuse, terrorist material, incitement. It can also mean harmful in the looser sense that platform trust and safety teams use, which covers self-harm, misinformation, harassment and anything a reviewer finds distasteful. A company that does not say which meaning it intends has reserved both.
There is a commercial logic to the timing. Apple has spent a decade selling privacy as a product attribute, in billboards and keynote slides, and that position has become harder to hold as regulators in several markets demand that platforms detect and report illegal material. A narrow, published-link policy gives the company something to point at when a government asks what it does, without requiring it to scan the contents of anyone’s phone. It is a hedge, and it is priced like one.
The cost of a hedge is that it satisfies nobody. Privacy groups will note that the definition of harmful is unstated and the appeal process is absent. Legislators will note that the check applies to links people chose to publish, not to the encrypted material they send to each other, which is where the hardest cases live. Both will be right.
For users, the practical question is what happens to a link that has been live for two years and is suddenly refused. Nothing in the support page describes a notification, and a link that silently stops resolving is indistinguishable from a link that expired, which iCloud links also do. A photographer whose portfolio link is disabled has no way to know why, and no stated route to ask.
Apple’s willingness to act before defining its terms is not unique. Every platform that has built content moderation has done it, and every one has discovered that the definition arrives later, in the form of enforcement decisions that nobody outside the company can see. The difference here is the audience. Apple’s users were promised something specific about what the company would not look at.
The version shipping in December will be the first draft, and the first draft of a moderation system is always the one with the widest discretion and the thinnest appeal. What arrives after it, in the form of policy pages and support articles and quiet revisions, will tell users more about the boundaries than the paragraph they were given this week. The open question is whether anyone outside Cupertino will be able to tell when those boundaries move.
