Apple Advanced Data Protection and the UK Technical Capability Notice
Advanced Data Protection, the Apple setting that extends end-to-end encryption to iCloud backups and stored files, has been unavailable to new users in the United Kingdom since February 2025. Apple withdrew it after the Home Office issued a demand, reported to be a technical capability notice under section 253 of the Investigatory Powers Act 2016, requiring the capability to access data stored in iCloud. On 4 August 2026 Apple confirmed it had filed a new complaint at the Investigatory Powers Tribunal. The legal question has still not been decided, and the practical position for UK users has not changed in eighteen months.
- ADP status for new UK users
- Unavailable since Feb 2025
- Apple statement via BBC News
- Claimed legal basis
- IPA 2016 s.253
- legislation.gov.uk
- Privacy International case
- IPT/25/83/CH, open
- Privacy International
- Substantive hearing listed
- December 2026
- Privacy International
What the notice regime actually is
Section 253 of the Investigatory Powers Act 2016 lets the Secretary of State give a telecommunications operator a notice requiring it to maintain the technical capability to give effect to interception warrants, equipment interference warrants, and communications data authorisations. The statutory design has two features that shape this entire dispute. The notice is not published, and the recipient is under a duty not to disclose its existence. That is why the record here is built from a February 2025 press leak, subsequent reporting, and what tribunal proceedings have forced into the open, rather than from any document either government or company has released.
Apple has not confirmed the contents of any notice, and the UK government does not comment on what it calls operational matters. The description of the demand as a technical capability notice comes from reporting and from Privacy International's filed case, not from an official publication.
Sequence of events
- Feb 2025RecordedDemand reportedThe Washington Post reports that the UK required Apple to maintain the capability to provide access to any data stored in iCloud by users anywhere in the world.
- Feb 2025WarningApple withdraws ADP in the UKAdvanced Data Protection stops being available to new UK users. Existing users are given a period to disable it themselves in order to keep using their iCloud account. The feature stays available everywhere else.
- Mar 2025RecordedSecret tribunal hearingA closed Investigatory Powers Tribunal hearing is scheduled for 14 March. Privacy International, Liberty, and two individual claimants file complaints seeking a public hearing and disputing the lawfulness and secrecy of the notice regime.
- 7 Apr 2025ConfirmedTribunal rejects total secrecyA public judgment summarises the findings. The government had argued it would be contrary to the public interest for any information about the case to be public. The tribunal rejects that, citing open justice. The full reasoning goes only to Apple and the Home Office.
- 23 Jul 2025RecordedCase management orderThe tribunal directs the government to agree assumed facts with Apple to support a seven-day hearing in early 2026, so that as much as possible can be heard in open. An application by WhatsApp to intervene is refused.
- Oct 2025CautionFirst notice withdrawn, second issuedThe Financial Times reports the UK withdrew the first notice and issued a second one targeting British users. Apple’s challenge is dismissed shortly afterwards for a change in circumstances rather than on the merits.
- Feb 2026RecordedAmended complaintPrivacy International and co-claimants file an amended complaint. Their challenge to the notice regime continues independently of Apple’s.
- 4 Aug 2026RecordedApple files a new claimApple confirms a new complaint at the tribunal. A case management hearing is set for September 2026 and the substantive hearing in the Privacy International claim is listed for December 2026.
The first notice was withdrawn for a reason that had nothing to do with UK users
The most consequential turn in this case is easy to misread. The first notice was reported to cover data belonging to Apple users anywhere in the world, which drew objections from United States politicians concerned about their own citizens' data. The notice was withdrawn, and the replacement issued in October 2025 was reported not to apply to US users.
The scope narrowed on nationality, not on principle. A demand that once reached globally now reaches British users specifically, which means the position of a UK account holder did not improve. Apple's first legal challenge fell away because the notice it was aimed at no longer existed. Reporting the dismissal as a loss for Apple would misstate the record; it was dismissed for a change in circumstances, and the fresh claim filed in August 2026 puts the same underlying power back before the tribunal.
What this changes for an iCloud account today
Advanced Data Protection is opt-in, and it governs a specific set of categories: iCloud backups, iCloud Drive, Photos, Notes, and voice memos. Without it, those categories sit under keys Apple holds, so Apple can produce the data when served with a valid legal demand. Categories that are end-to-end encrypted by default, including iMessage content, Health data, and iCloud Keychain passwords, are not affected by this setting.
The practical detail that matters most is the iPhone backup. An end-to-end encrypted messenger loses much of its protection if the device backs up its message history to storage the provider can read. For a UK user who cannot enable Advanced Data Protection, disabling iCloud Backup is the difference between message history being reachable through Apple and not being reachable through Apple, and that choice sits with the user regardless of how the litigation ends.
What has not been decided
No tribunal has ruled that the UK can require a company to break end-to-end encryption, and no tribunal has ruled that it cannot. The only public ruling so far concerns secrecy: the tribunal held in April 2025 that the case could not be conducted entirely in the dark. The lawfulness, necessity, and proportionality of the notice regime are the subject of the Privacy International claim, case number IPT/25/83/CH, which is listed for a substantive hearing in December 2026 and remains open.
The government's public framing has been consistent throughout: it says it supports strong encryption and robust privacy protections while maintaining that law enforcement must be able to access communications when necessary and proportionate. Both halves of that sentence are being tested in a forum whose central feature is that most of it is not public.
The current legal status of this measure, alongside other state actions on encryption and age verification, is tracked on the policy tracker. Related coverage of how encryption is handled across messaging products is in Private Messaging Apps Compared, and the wider UK age-assurance regime is covered in Age Verification and Privacy.
Sources
Frequently Asked Questions
Can UK users turn on Advanced Data Protection?
No. Apple withdrew Advanced Data Protection for new UK users in February 2025 and it has not been restored. Users who already had it enabled were given a period to disable it themselves in order to keep using their iCloud account. The feature remains available to users outside the UK.
What is a technical capability notice?
A technical capability notice is a notice issued under section 253 of the Investigatory Powers Act 2016 requiring a telecommunications operator to maintain the technical capability to give effect to interception, equipment interference, or communications data acquisition. The notices are secret and recipients are placed under a duty not to disclose them, which is why the Apple case has been reported largely through leaks and litigation rather than published notices.
Which iCloud data is affected when Advanced Data Protection is off?
Advanced Data Protection is the opt-in setting that extends end-to-end encryption to iCloud backups, iCloud Drive, Photos, Notes, and voice memos. With it unavailable, those categories are held under encryption keys Apple retains, so Apple can produce that data in response to a valid legal demand. Categories that are end-to-end encrypted by default, such as iMessage content, Apple Health data, and passwords in iCloud Keychain, are not governed by this setting.
Has a court ruled that the UK can require a backdoor?
No. The Investigatory Powers Tribunal has not ruled on the lawfulness of the notice. Its April 2025 public judgment was about secrecy, and it rejected the government position that no information about the case should be public. Apple’s first challenge was dismissed for a change in circumstances after the first notice was withdrawn, not on the merits. Apple filed a fresh claim in August 2026 and the underlying question remains undecided.