Apple removes advanced data protection - Here is a Workaround Solution to Fix this iCloud Invasion

In January 2025 the Home Office secretly ordered Apple to break its own encryption. Apple pulled Advanced Data Protection from the UK rather than comply, and more than eighteen months later British users still cannot turn it back on. Here is where the case actually stands, what you lost, and what you can do about it.

How we got here

1. January 2025 — the secret order

   The Home Office issues a Technical Capability Notice under the Investigatory Powers Act 2016. Its reported scope is blanket access to Advanced Data Protection content for any Apple user worldwide — not assistance with a named suspect. Under the Act, merely confirming such a notice exists is an offence.

2. February 2025 — it becomes public

   The Washington Post reveals the order. It has no known precedent among major democracies: a demand for standing capability to read fully encrypted material held by a foreign company on behalf of the entire world's users.

3. February 2025 — Apple withdraws the feature

   Rather than build the access, Apple removes Advanced Data Protection for UK users. New users cannot enable it; existing users are required to turn it off. Apple's position is that it has never built a back door or master key and never will.

4. March–April 2025 — the tribunal

   Apple complains to the Investigatory Powers Tribunal, the only UK court that can hear certain national-security cases. In April the tribunal refuses the government's request to keep even the bare details of the case secret, noting how much had already been said publicly.

5. August 2025 — the worldwide demand is dropped

   Following intervention from the US administration, the UK withdraws the global element of its demand. This is presented as a resolution. It is not.

6. Autumn 2025 — a second, narrower notice

   The Home Office issues a replacement notice, this time targeting the encrypted data of British users only. The principle is unchanged; only the geography is.

7. July 2026 — Apple challenges again

   Apple files a fresh complaint at the tribunal against the rewritten notice. The tribunal is hearing it alongside cases brought by Privacy International, Liberty and two private individuals, in public, using agreed "assumed facts" rather than classified detail.

A demand narrowed from everyone in the world to everyone in Britain is not a concession. If you live here, it is the same demand.

What Advanced Data Protection actually protected

Apple's iCloud encryption comes in three tiers, and most coverage blurs them together. Knowing which is which tells you exactly what you lost — and what was never protected in the first place.

Eight workarounds that do not work

Every one of these comes up whenever this subject is raised. None of them solves the problem, and several of them leave people worse off because they believe they are protected when they are not.

What to do instead

• Turn off every cloud backup and sync on the phone, as set out at the top of this page — device backup, photos, drive and per-app backups including WhatsApp.
• Put a UniFi NAS on your own network as the destination for photos and files, running offline or with access locked down. This is the piece that replaces iCloud.
• Automate the photo backup. UniFi Drive 4.0 added automatic local photo and video backup from iPhone and iPad through the licence-free UniFi Endpoint app — no subscription and no third-party cloud in the path. For Android, or for finer control over albums and formats, PhotoSync does the same job to a network target.
• Use ProtonDrive where you need genuine cloud access — files that must be reachable from anywhere, or shared with someone else.
• Use Proton Docs for documents and notes instead of iCloud Notes or Google Docs. End-to-end encrypted, and enough for most everyday writing.
• Use Signal for anything sensitive, on both phone and desktop.
• Use ProtonMail for personal and domain email, remembering that full end-to-end protection only applies between Proton users.
• Use ProtonPass as your password manager, on desktop and phone.
• Run proper anti-malware such as ThreatDown. Endpoint compromise defeats every other measure on this list.
• Install fewer apps, and read the permissions. Some apps carry data-sharing arrangements you would not agree to if asked plainly.
• Be ruthless about browser extensions. An extension can read every page you visit. Stolen sessions and saved credentials are traded on the dark web in bulk, in what are known as stealer logs.

Storage you actually control — without a science project

We used to point people at self-hosted NextCloud for this. In practice it asks too much: a server to maintain, updates to keep on top of, and a support burden that lands on whoever in the household is least able to refuse. Most people set it up, fall behind on patching, and end up with something less safe than what they left.

The setup we now recommend has no server administration in it at all.

The device settings almost nobody turns on

Everything above is about who holds the keys to your data in the cloud. This section is about the other half of the problem: what happens when someone has your unlocked phone in their hand, or has watched you type the passcode. Both platforms have added serious protections for exactly this, and most people have never opened the menu.

Be clear about what these do and do not achieve. They defeat a thief, an opportunist, or someone who has shoulder-surfed your PIN. They do not stand between a cloud provider and a lawful order — that is what the rest of this page is for.

On iPhone

On Android

The law that makes this possible

This is not a bill and it is not new. The Investigatory Powers Act 2016 — the "Snoopers' Charter" — is in force, and was strengthened by the Investigatory Powers (Amendment) Act 2024, which among other things requires companies to notify the Home Office before making changes that would affect an existing capability. In practice that means a provider can be obliged to hold off on shipping a privacy improvement.

Rights groups have consistently flagged the same features of the regime:

• Internet connection records retained for up to twelve months — a list of the sites and services a person used, held for everyone regardless of suspicion.
• Equipment interference — explicit legal authority for agencies to hack devices and networks, on both a targeted and a bulk basis, with targets that can be broadly defined.
• Bulk interception — a statutory footing for the mass collection practices disclosed by Snowden, including tapping the cables carrying internet traffic in and out of the UK.
• Compelled capability — companies can be required to maintain technical means to assist, and to remove electronic protection they applied. This is the clause the Apple notice rests on.
• Limited judicial review — a judge approves warrants, but reviews whether the process was followed and the decision was reasonable, rather than re-taking the decision. Urgent cases can proceed before that review, with urgency decided by the person issuing the warrant.

Why this matters even if you have nothing to hide

The argument for these powers is serious crime and terrorism. The difficulty is that the people running sophisticated criminal operations are not backing their plans up to consumer iCloud accounts — they know the risk, and they use other tooling. What blanket access actually delivers is a searchable record of ordinary people's emails, photographs and documents, available to a widening circle of departments for increasingly routine purposes. AI now makes sifting that material trivial, which changes the calculation: the practical limit on mass surveillance used to be the cost of reading it all, and that limit has gone.

Plenty of people say they do not care about privacy. Rather more of them would object to a stranger reading their family photographs, their medical correspondence and their bank statements, which is the same thing described accurately.

Sources and further reading

• The Washington Post — the original February 2025 report revealing the order and its worldwide scope.
• Amnesty International and Human Rights Watch — joint response setting out the harm to privacy rights in the UK and globally.