Enable Advanced Data Protection for iCloud (2026)
Advanced Data Protection end-to-end encrypts your iCloud backups, Photos, and Notes so not even Apple can read them. Here is how to switch it on.
By default, Apple holds the encryption keys to most of your iCloud data, which means Apple can hand it over to law enforcement or lose it in a breach. Advanced Data Protection flips that: it end-to-end encrypts the bulk of iCloud so the keys live only on your devices. The catch is that if you lose access, nobody, not even Apple, can recover it.
Quick answer
On your iPhone, go to Settings, tap your name, tap iCloud, then Advanced Data Protection, and turn it on. You must first set up a recovery method (a recovery contact or a recovery key) and update every device signed into your account. Once enabled, iCloud Backup, Photos, Notes, and more become end-to-end encrypted, so only your trusted devices can decrypt them.
Key takeaways
- Advanced Data Protection (ADP) end-to-end encrypts most iCloud categories, including backups, Photos, and Notes.
- Not even Apple can read your data once ADP is on, which also means Apple cannot recover it for you.
- You must set up a recovery contact or recovery key first; this is your only lifeline if you lose your devices.
- Every device on your account must be updated; older devices block ADP until they are upgraded or removed.
- A few things stay unencrypted, including Mail, Contacts, Calendar, and some sharing features.
What ADP does and does not cover
Standard iCloud already encrypts data in transit and on Apple's servers, but for most categories Apple keeps a copy of the key. ADP removes Apple's key for the majority of your data. That is a big security upgrade against server-side breaches and compelled access, but it shifts all responsibility for recovery onto you.
| iCloud category | Standard protection | With ADP |
|---|---|---|
| iCloud Backup | Apple holds key | End-to-end encrypted |
| Photos | Apple holds key | End-to-end encrypted |
| Notes | Apple holds key | End-to-end encrypted |
| iCloud Drive | Apple holds key | End-to-end encrypted |
| Mail, Contacts, Calendar | Standard | Still standard (not E2E) |
| Shared "anyone with link" content | Standard | Not E2E while shared |
Mail, Contacts, and Calendar cannot be end-to-end encrypted because they must interoperate with global systems like IMAP and CalDAV. iWork collaboration and Shared Albums also stay outside ADP.
Before you turn it on
ADP will not enable until you have a recovery path, because it is the only way back in if all your devices are lost.
Set up a recovery method
You need at least one of these:
- A recovery contact: someone you trust who can help you regain access.
- A recovery key: a 28-character code you store somewhere extremely safe (a password manager or a printed copy in a secure place).
If you lose both your devices and your recovery method, your end-to-end encrypted data is gone permanently. This is not Apple being difficult; it is the whole point of end-to-end encryption.
Update every device
All devices signed into your Apple Account must run a version that supports ADP. Any device that is too old will block the feature. Either update it or remove it from your account.
Warning
There is no back door. If you enable ADP and later lose your only device plus your recovery key and recovery contact, Apple physically cannot restore your Photos, backups, or Notes. Treat the recovery key like the deed to your house.
Turn on Advanced Data Protection
- Open Settings and tap your name at the top.
- Tap iCloud, then scroll down and tap Advanced Data Protection.
- If prompted, tap Set Up Account Recovery and add a recovery contact or generate a recovery key.
- Store the recovery key somewhere secure and confirm it when asked.
- Tap Turn On Advanced Data Protection and follow the prompts to finish.
On a Mac, the same option lives under System Settings, your name, iCloud. Enabling it on one device applies it across your account.
Fitting ADP into your security setup
ADP is one of the strongest privacy switches Apple offers, and it pairs naturally with other hardening steps. If your Apple Account itself is weakly protected, ADP matters less, so lock down sign-in with a strong unique password and a passkey where possible; our guide to choosing a secure password manager covers where to store your recovery key safely. For physical-theft scenarios, combine ADP with Stolen Device Protection on iPhone, which adds a biometric-and-delay layer around sensitive changes.
What to do right now
- Update every Apple device signed into your account to the latest OS.
- Set up a recovery contact and generate a recovery key, then store the key in a password manager or a secure physical location.
- Open Settings, your name, iCloud, Advanced Data Protection, and turn it on.
- Verify the toggle shows as enabled and note which categories remain standard (Mail, Contacts, Calendar).
- Add Stolen Device Protection for a complete phone-theft defense.
Frequently asked questions
Can Apple recover my data if I enable ADP and lose my devices?
No. That is the defining feature of end-to-end encryption. Your recovery contact or recovery key is the only way back in, so set one up before enabling and guard it carefully.
Does ADP encrypt my email?
No. Mail, along with Contacts and Calendar, stays on standard protection because it must interoperate with worldwide email and calendar systems that do not support end-to-end encryption.
Will ADP slow down my iCloud or backups?
No noticeable difference in everyday use. Encryption and decryption happen on your devices, and syncing works the same way it did before.
Do I need to enable ADP on every device separately?
No. ADP is an account-level setting. Turn it on once and it applies across all devices signed into that Apple Account, provided they all meet the version requirement.
What happens to shared albums and links?
Content you share with "anyone with the link," Shared Albums, and iWork collaboration is not end-to-end encrypted while it is shared, even with ADP on. Keep that in mind for anything highly sensitive.
