Turn on Advanced Data Protection if you want Apple to be unable to read your iCloud photos, backups, notes and iCloud Drive, and if you are ready to keep your own recovery key. With it on, Apple holds no key to that data. The cost is that Apple also cannot help you if you lose access to your account.
Your iPhone sends a lot of your life to iCloud: every photo, a full backup each night, your notes and the files in iCloud Drive. With the default setting, Apple encrypts that data and keeps the key. This is how Apple can restore your photos when you forget your password, and it is also how Apple can read them when it must, for example to answer a court order. Since iOS 16.2, Apple has offered a setting that removes its copy of the key. It sounds like an obvious choice, but it moves a real responsibility to you. So should you turn it on, and what changes when you do?
This guide first explains what Advanced Data Protection changes, then what you give up, and then who it suits. The last parts give the steps to turn it on and answer common questions.
Advanced Data Protection takes Apple's key away from most of your iCloud data
With the default setting, which Apple calls standard data protection, 15 types of iCloud data are end-to-end encrypted. These include your passwords, Health data and Messages in iCloud. Apple holds the keys to the rest. Advanced Data Protection raises the number of end-to-end encrypted types to 25.
| Data | With ADP | Standard | Never |
|---|---|---|---|
| Passwords, Health and Messages in iCloud | End-to-end | End-to-end | No |
| Photos and iCloud Backup | End-to-end | NoApple holds the key | No |
| Notes, iCloud Drive and Reminders | End-to-end | NoApple holds the key | No |
| iCloud Mail, Contacts and Calendars | No | No | YesNever end-to-end |
The most important change is iCloud Backup. A backup holds a copy of almost everything on your iPhone. With standard data protection, it also holds the key to your Messages in iCloud, so Apple can get to your messages through the backup. With Advanced Data Protection, Apple cannot open the backup.
Some data stays readable by Apple. iCloud Mail, Contacts and Calendars use open standards that other mail and calendar systems must read, so Apple cannot encrypt them end-to-end. Dates, file sizes and other metadata also keep standard protection. What is end-to-end encryption? explains the difference between the two kinds of protection.
The cost is that nobody can help you get your data back
With Advanced Data Protection, only your trusted devices hold the keys. If you lose access to all of them and you forget your Apple Account password, Apple cannot restore your data. Apple says that it "will not have the encryption keys to help you recover it".
So before you turn it on, iOS asks you to set up at least one of these recovery methods:
- A recovery contact. A person that you trust, with an Apple device. They cannot see your data. They can only give you a code to get back into your account.
- A recovery key. A 28-character code that you write down and keep in a safe place.
There are smaller costs too. Access to your data on iCloud.com is off by default, and if you turn it on, you must approve each sign-in on a trusted device. Every device that is signed in to your Apple Account needs up-to-date software. And Advanced Data Protection may not be available in every country or region.
Shared things keep standard protection
End-to-end encryption protects data between your own devices. When you share, the other person needs a key too. Apple handles this in two ways:
- End-to-end if everyone has it on. An iCloud Shared Photo Library, shared folders in iCloud Drive and shared notes stay end-to-end encrypted, but only if every participant has Advanced Data Protection on.
- Standard protection always. Shared Albums in Photos, iWork collaboration and anything that you share with "anyone with the link" use standard data protection, even with the setting on.
If you keep private photos in a Shared Album, Advanced Data Protection does not change who can read them.
It suits most people who can keep a recovery key safe
Advanced Data Protection is a good choice if any of these is true:
- You keep private photos, documents or notes in iCloud, and you do not want Apple, or a person who gets into Apple's systems, to be able to read them.
- You use iCloud Backup and you want your messages to stay end-to-end encrypted.
- You have a person that you trust as a recovery contact, or a safe place for a recovery key.
Keep the default setting if you are likely to lose both your devices and your password, and you have nobody to be a recovery contact. Losing all your photos is a real risk too, and the default setting protects you from it.
Advanced Data Protection protects your data on Apple's servers. It does not protect it on your iPhone. A person who knows your passcode can still open your photos, your notes and your Hidden album on the device. Someone knows your iPhone passcode explains what to do about that.
How to turn on Advanced Data Protection
- Update your iPhone, and every other device that uses your Apple Account, to the latest software.
- Open the Settings app and tap your name. Then tap iCloud.
- Scroll down and tap Advanced Data Protection.
- Tap Turn on Advanced Data Protection. Follow the steps to set up a recovery contact or a recovery key.
When you turn it on on one device, it is on for your whole account. You can turn it off at any time in the same place. Your device then sends the keys to Apple again, and your account goes back to standard data protection.
How DotSafe fits with Advanced Data Protection
DotSafe does not depend on this setting. It encrypts each item on your device with a key that comes from your pattern. With Pro, it syncs a vault through your private iCloud database, and it encrypts every block before it uploads it. Apple cannot read those blocks with either setting, and we never receive them. DotSafe also keeps its vaults out of your iCloud Backup, so a backup holds no copy of them.
The two work well together. Advanced Data Protection protects the rest of your iCloud data from Apple. A vault protects your most private things from a person who knows your passcode.
Questions
Is Advanced Data Protection on by default?
No. Standard data protection is the default for every Apple Account. You must turn on Advanced Data Protection yourself in Settings, under your name, then iCloud.
Can Apple see my photos with Advanced Data Protection?
No. With Advanced Data Protection on, iCloud Photos is end-to-end encrypted, and Apple holds no key to it. Photos in a Shared Album keep standard protection.
What happens if I lose my recovery key?
A recovery key is one of your recovery methods. A trusted device or a recovery contact can still help you get back into your account. If you lose all your devices, your recovery contact and your recovery key, Apple cannot recover your end-to-end encrypted data.
Does Advanced Data Protection encrypt iCloud Mail?
No. iCloud Mail, Contacts and Calendars are not end-to-end encrypted, because they must work with mail and calendar systems from other companies.
Sources
We checked these pages on 8 November 2026.
