Digital Sovereignty

Your UK iCloud Backup Lost Its Encryption in 2025

Apple has gone back to the Investigatory Powers Tribunal over a second UK backdoor order. Advanced Data Protection has already been off in Britain since February 2025, and the new notice was scoped to survive the objection that killed the first one.

Digital SovereigntyBy Servola Tech Desk2026-08-034 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Key takeaways

Advanced Data Protection has been unavailable in the United Kingdom since February 2025, so the 25 iCloud categories it covers, iCloud Backup and Photos and Notes among them, are not end-to-end encrypted on any UK account today, and no ruling in Apple's new case gives back the eighteen months already stored that way.
The first order was withdrawn because it reached American users and Washington objected. The replacement notice is scoped to UK users only, which removes the diplomatic lever that worked and leaves a British business with a domestic legal question and no foreign ally.
Both Apple and the Home Office are barred by law from discussing a technical capability notice, so the case that decides your backup encryption runs in a proceeding neither party may describe to you.
The parallel challenge brought by Liberty and Privacy International is listed for December, which makes that the earliest month in which anything public happens. Plan on the current position holding through the rest of this year.
Check which country your company's Apple accounts are registered to before you assume this is someone else's problem. Availability follows the account region, not the office address.

The feature has been gone for eighteen months

On 21 February 2025 Apple stopped offering Advanced Data Protection to new users in the United Kingdom and told existing UK users they would eventually have to switch it off. The company's own support note is unusually blunt for a document of that kind: Apple can no longer offer the feature in the UK. It did not soften the reason, and it did not offer a replacement.

What the feature does is worth restating, because the headline word encryption is doing a lot of work. Without Advanced Data Protection, iCloud still encrypts your data, but Apple holds keys it can be compelled to use. With it, the number of data categories under end-to-end encryption rises to 25, and iCloud Backup is one of them. An iPhone backup contains most of what is on the phone. That is the category that changed hands in February 2025, and it has stayed changed every day since. Messages in iMessage and calls on FaceTime remain end-to-end encrypted everywhere, including Britain, which is why the loss is easy to miss: the visible things still look protected.

The second notice was written to remove America's veto

The order Apple is now fighting is not the one it fought in 2025. The Home Office's first technical capability notice reached the data of American as well as British customers, and that reach is what defeated it. Washington objected, the diplomatic cost climbed, and in August 2025 the UK backed down. The notice issued afterwards asks for the same architectural thing and asks for it only in respect of UK users.

Read that as engineering rather than diplomacy and the design becomes clear. The first attempt failed on a jurisdictional fact, not on a principle, so the second attempt removed the jurisdictional fact. Nobody in Washington now has standing to be annoyed on a British company's behalf. Apple's technical argument has not changed and does not depend on scope, because a key that exists can be compelled, copied or stolen regardless of which passports its intended targets hold. But the political argument that actually worked last time has been engineered out of the problem.

A case that neither side is allowed to describe

Apple filed its new complaint with the Investigatory Powers Tribunal in July. That is the same forum, and the same statutory machinery, as the challenge Liberty and Privacy International brought under section 253 of the Investigatory Powers Act. Neither Apple nor the Home Office may comment publicly on a technical capability notice; the secrecy is not a choice either party made.

How much becomes public is itself contested. At a hearing in March 2025 the Home Secretary argued that national security would be threatened by publishing even the bare details of the case, including the names of the parties, and the Tribunal rejected that. Tessa Gregory, acting for the claimants, welcomed the refusal in those terms. Akiko Hart of Liberty put the stake in ordinary language: end-to-end encryption protects bank details, health information, private conversations and images. The Liberty and Privacy International case is listed to be heard in December, so December is the first month in which an outsider learns much of anything.

What to settle before December

Treat the current position as the planning assumption rather than a temporary irregularity, because it has already outlasted most people's memory of it. If your organisation issues UK-region Apple accounts, device backups for those accounts are not end-to-end encrypted and have not been for eighteen months. That is a fact about your estate today, not a risk that might arrive after a judgment.

Two things are worth doing while the tribunal is quiet. Establish which region your company's Apple accounts are actually registered to, since availability follows the account, and an organisation with staff in several countries will find its exposure is not uniform. Then decide, deliberately, whether device backups are the right place for the material that matters most to you, given that in one of your jurisdictions the provider holds usable keys. That decision does not need a verdict. It needs an inventory.

Frequently asked questions

Does this affect iMessage and FaceTime?

No. Those services remain end-to-end encrypted everywhere, including in the United Kingdom. The change is to the iCloud categories that Advanced Data Protection covers, and iCloud Backup is the consequential one, because a device backup contains a great deal of what the encrypted apps produced.

If Apple wins, does encryption come back automatically?

A win removes the notice; it does not undo storage. Everything backed up from a UK account since February 2025 was written without end-to-end encryption and stays that way. Treat restoration of the feature as the best case and the historic data as already exposed to compelled access.

We are outside the UK. Is there anything to check?

Yes, one thing. Advanced Data Protection availability follows the region an Apple account is registered to, not the country your office is in. A company with British staff, British subsidiaries or accounts created while resident in the UK can hold UK-region accounts without having decided to.

The reporting frames this as Apple against the Home Office, and on the pleadings it is. For anyone running an estate of devices it is something duller and more settled than a fight: a capability that was removed, has stayed removed for a year and a half, and will not be restored by the earliest date on the calendar. The organisations that come out of this well will not be the ones that guessed the verdict. They will be the ones that stopped treating an unresolved case as a reason to leave the question open.

AppleInvestigatory Powers ActInvestigatory Powers TribunalAdvanced Data Protectionend-to-end encryptionHome OfficeLibertyPrivacy InternationaliCloudUK data law

Apple's Services Shrank From One Quarter To The Next

Apple Services revenue slipped to 30.74 billion dollars from 30.98 billion, the first sequential fall since 2022. Kevan Parekh named mobile gaming and App Store rule changes in three markets.

6 min read

Consumer Tech

Apple Doubled Its Inventory and Guided Down

Apple nearly doubled inventory to 11.1 billion dollars and still guided September growth down to 9 to 11 percent. Tim Cook called memory pricing a hundred-year flood.

5 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.

3 min read

← All articles