Checked against Apple’s own pages on 23 October 2026. Apple changes these pages, so category counts are dated, and where a sentence is our own reading we say so.
The short answer
Not by default. Apple says that under standard data protection “Apple can decrypt your data on your behalf whenever you need it” (Apple: iCloud data security overview). Advanced Data Protection (ADP) is an opt-in setting that moves most iCloud categories to end-to-end encryption, but Apple lists iCloud Mail, Contacts and Calendar as outside it.
What Apple says
- Standard protection is the default. Apple’s overview describes standard data protection as the default; under it the encryption keys for most categories are “secured in Apple data centers”. A smaller set is end-to-end encrypted even under standard protection. Apple’s page lists, for example, iCloud Keychain, Health and Messages in iCloud. (overview)
- ADP is opt-in. Turning it on requires updated software on every signed-in device (or removing a blocking device from the account) and at least one recovery method. Apple says turning it on from one device enables it for your entire account. (Apple: turn on ADP)
- Category counts. Apple’s current overview lists 15 end-to-end encrypted categories by default and 25 with ADP. When ADP launched in December 2022, Apple said 14 and 23. (Apple newsroom, December 2022) These numbers change, so read the live page.
- What ADP does not cover. Apple lists iCloud Mail, Contacts and Calendar as protected “in transit & on server”, with Apple holding the keys with ADP on or off. Apple gives email interoperability as the reason for Mail, and says the CalDAV and CardDAV standards used for Calendar and Contacts lack built-in end-to-end encryption support. (overview)
- Metadata. Apple says some metadata and usage information remains under standard protection with ADP on, with the keys still stored by Apple. For iCloud Drive its page lists, among other things, file names, file types, sizes, dates and checksums. (overview)
What that means (our reading)
Because Apple holds the keys under standard protection, it follows that Apple is technically able to access that data, and that legal process directed at Apple could reach it. Apple does not put it that way on the pages above, and we have not checked its law enforcement guidelines for this post, so treat that as our reading of key custody. Metadata such as file names, dates and checksums can reveal a lot even when contents are encrypted; that is our analysis, not an Apple statement.
For the categories ADP does cover, Apple says it “doesn’t access or store keys for any end-to-end encrypted data”. We would call that zero-knowledge for those categories. That is our term, not Apple’s.
ADP in the United Kingdom
Apple states: “Apple can no longer offer Advanced Data Protection in the United Kingdom to new users.” Users who had not already enabled it “will no longer have the option”, and Apple says it cannot disable ADP automatically for those who already had it. (Apple: ADP in the UK) Apple’s statement does not explain why. The press has reported a UK government demand for access and later developments; the UK government has not confirmed them, so we do not summarise them here.
Our reading: a feature that can be withdrawn in one country is different from a design where the provider never had the keys in the first place.
If you stay on Apple
Apple’s own documentation is the place to decide. If you want the protection, ADP is what moves most categories to end-to-end encryption. Apple says recovery methods are never shared with or known to Apple, which means you must keep your recovery key safe; our reading is that Apple then cannot restore access for you.
What Beebeeb does, and what it costs
Beebeeb encrypts files on your device with AES-256-GCM before upload and derives your keys with Argon2id, in every plan, so we store ciphertext and cannot read your files. The apps (web, desktop, iOS and the CLI) are open source and the server is not; see our encryption page.
It has costs. We cannot recover your files if you lose both your password and your recovery phrase. There has been no independent security audit yet. There is no free plan, only a free trial. Files are stored in the EU. On price per terabyte Apple is cheaper than us at some tiers; we keep a dated table at cloud storage prices and a side-by-side at Beebeeb vs iCloud. Beebeeb is not a US company. We have not analysed how the CLOUD Act applies to Apple in every case; the statute says providers must disclose data in their possession, custody or control regardless of where it is stored, subject to legal process (statute text).
Common questions
Is iCloud zero-knowledge? Not by default. With ADP on, Apple says it holds no keys for the end-to-end encrypted categories; Mail, Contacts and Calendar stay outside that.
Is iCloud end-to-end encrypted? Partly. Apple lists some categories as end-to-end encrypted by default and more with ADP.
Can Apple read my iCloud files? Under standard protection Apple says it can decrypt your data on your behalf. With ADP on, Apple says it does not hold keys for the covered categories.
Does ADP encrypt iCloud Mail? No. Apple lists Mail, Contacts and Calendar as not end-to-end encrypted.