Apple challenges new UK government demand for access to encrypted iCloud data

Apple has appealed a new legal order from the UK government demanding that the company provide a way to access data protected by its Advanced Data Protection feature, an optional setting that applies end-to-end encryption to iCloud backups so that not even Apple can read the contents. The order marks a fresh chapter in a dispute that first became public when Apple withdrew Advanced Data Protection for UK customers earlier in response to a previous government demand.

Advanced Data Protection encrypts categories of iCloud data, including device backups, photos and notes, in a way that only the account holder holds the decryption keys. Apple has marketed the feature as protection against data breaches, government overreach and unauthorised access by anyone other than the account owner, including Apple itself.

The UK government's demand reportedly stems from powers under the Investigatory Powers Act, legislation that allows authorities to compel telecommunications and technology companies to provide assistance with lawful data access requests, including in some cases requiring companies to build technical capabilities that make such access possible. Critics of the law have long argued its secrecy provisions, which can bar companies from publicly disclosing the existence of a specific order, make independent oversight difficult.

Apple's public position, repeated across previous rounds of this dispute, is that it does not build backdoors into its products for any government, arguing that any mechanism created to allow lawful access for one government could be discovered and exploited by malicious actors, or demanded by other governments seeking similar access to their own citizens' data. The company has said complying with such orders would require weakening encryption for all users of the affected feature, not just UK-based accounts, depending on how the technical implementation is designed.

UK officials have defended the demand as necessary for law enforcement and national security investigations, arguing that strong encryption without any lawful access mechanism can shield serious criminal activity, including child exploitation material and terrorism-related communications, from investigation even when authorities have a valid warrant.

Privacy and digital rights groups have sided with Apple's position, arguing that any backdoor mechanism, regardless of the legal safeguards intended to limit its use, represents a structural weakness that undermines security for all users of the product, not only those under investigation. Security researchers have made similar arguments in the past about mandated access mechanisms for encrypted messaging services.

The legal challenge is expected to be heard by the UK's Investigatory Powers Tribunal, the body responsible for reviewing complaints about surveillance powers, though proceedings related to national security matters are often held at least partially in closed session, limiting public visibility into the arguments made by both sides.

Other governments have pursued similar approaches to encrypted services in recent years, including proposed legislation in the European Union aimed at scanning encrypted messages for illegal content before encryption is applied, an approach critics have labelled a backdoor by another name. Technology companies including Apple, Meta and Signal have opposed several of these proposals on similar technical and privacy grounds.

The outcome of the UK case could set a significant precedent for how far a government can compel a technology company to alter its encryption architecture, and whether courts will treat a technical capability requirement differently from a request for specific existing data. Legal experts following the case say a ruling favouring the government could encourage similar demands from other jurisdictions.

Apple has not said whether it would withdraw Advanced Data Protection entirely from the UK market again if the legal challenge fails, as it previously did in response to an earlier version of the demand. For now, the company says the feature remains unavailable to new UK customers while the dispute over the broader legal order continues.