What does Apple axing encryption tool mean for UK users' data safety?

Apple is stripping Brits of its strongest data security tool in an unprecedented move for the privacy advocate, bowing to government demands for access to user data. Advanced Data Protection (ADP) is a privacy setting that ensures only account holders can view their iCloud data, including photos and files, with no entry for Apple or outsiders thanks to end-to-end encryption.

However, after the UK government demanded broad access to fully encrypted data, Apple has decided to disable ADP in the country. Here’s everything you need to know about the change and what it means for your data. At its core, Advanced Data Protection (ADP) is a privacy feature designed to safeguard your iCloud backups, which include some of your most personal data — things like photos, videos, and messages. These backups are crucial if you lose or upgrade your iPhone, allowing you to restore everything seamlessly.

With ADP enabled, your iCloud backups are encrypted, meaning only you can access them. Not even Apple can view your data, ensuring that it can't be shared with law enforcement or any other parties without your consent. Apple argues that this protection is vital to keeping users safe, and creating a "backdoor" to allow access to encrypted data would inevitably open it up to hackers.

However, in response to government demands for access to encrypted material, ADP will be removed in the UK, meaning iCloud data will no longer be encrypted. This shift means Apple could be required to share your data with authorities under certain circumstances, such as with a warrant.

Apple began removing the ADP service for new users at 3 p.m. on Friday, with plans to nix it for existing users at a later date. End-to-end encryption scrambles messages into a code that can only be deciphered by the devices sending and receiving them. Tech companies like Apple claim the feature is a bedrock of private communications, a view that has pitted them against the UK government.

Earlier this month, it was reported that the Home Office demanded Apple provide access to encrypted files uploaded to the cloud by users worldwide. The request, made under the Investigatory Powers Act 2016, compels companies to assist authorities in collecting evidence when required. The order sought blanket access to fully encrypted material, not just assistance with individual accounts.

While Apple has the right to appeal the UK’s order, it cannot delay its implementation during the appeal process. Globally, police and security services have called for greater access to encrypted communications, arguing that it helps thwart criminal activities such as terrorism and child exploitation.

However, tech companies maintain that users’ right to privacy must be protected, warning that creating backdoors for security services could be exploited by criminals or authoritarian regimes. Apple has been one of those companies consistently opposing efforts that it claimed would weaken encryption and compromise user privacy.

For years, Apple has promoted the privacy settings it provides its users as standard, which has led to clashes with governments. Here in the UK, it previously threatened to remove iMessage and FaceTime over proposed updates to surveillance laws. In a statement about the latest change, Apple said it was "gravely disappointed" that the security feature would no longer be available to British customers.

"As we have said many times before, we have never built a backdoor or master key to any of our products, and we never will", it added. Apple’s decision to effectively kill ADP in the UK has been roundly condemned by privacy campaigners and security experts.

Matthew Green, a cryptography expert and professor at Johns Hopkins University, clarified that Apple's decision to disable ADP in the UK will not impact iMessage encryption, iCloud Keychain, FaceTime, or health data, which will remain end-to-end encrypted.

He added that existing UK users will retain ADP for now but may eventually be given the option to turn it off manually. Green also encouraged users outside the UK to enable ADP, noting that greater adoption could make it harder for Apple to discontinue the feature.

According to Prof Alan Woodward, Visiting Professor of Computing at the University of Surrey, the security of data stored directly on Apple devices is unaffected by the removal of ADP. This change only impacts iCloud, he explained, where users' data (including iMessages) can be backed up. For those who want to ensure the long-term privacy and security of their data, Woodward advised against using iCloud and recommended disabling the backup feature if they wish to keep their data out of the cloud.

Rebecca Vincent, interim director of the privacy and civil liberties campaign group Big Brother Watch, criticised Apple’s decision, attributing it to the Home Office’s demand to breach encryption. She said: “This decision by Apple is the regrettable consequence of the Home Office’s outrageous order attempting to force Apple to breach encryption. As a result, from today Apple’s UK customers are less safe and secure than they were yesterday.”.