Advanced Data Protection is an optional Apple setting that gives your trusted devices sole access to the keys for most iCloud data, raising end-to-end encrypted categories from 15 to 25. It needs two-factor authentication and a recovery contact or key, and Apple cannot help you recover data if you lose all of them.
What changes
Under standard protection, 15 data categories are end-to-end encrypted. With Advanced Data Protection that rises to 25. Apple lists additions including iCloud Backup, Photos, Notes, iCloud Drive, Reminders, Safari Bookmarks, Shortcuts, Voice Memos, Wallet passes and Freeform.
You can turn it off at any time, and the account returns to standard protection.
Requirements
- Two-factor authentication on your Apple Account
- A supported OS version (iOS 16.2, iPadOS 16.2 or macOS 13.1 or later), with every signed in device updated to a version that supports the feature
- At least one recovery contact or personal recovery key set up before you turn it on
What stays outside end-to-end encryption
Apple's page is specific. These remain under standard protection, with Apple holding keys:
- iCloud Mail, Contacts and Calendars
- Reminders synced over CalDAV
- Content shared through links, Shared Albums and iWork collaboration, which use keys uploaded to Apple
- Metadata such as backup device names, backup dates and sizes, file types and modification dates
- Most third party app data outside iCloud Backup and CloudKit encrypted fields
Mail is the one executives notice most. Turning the setting on does not make iCloud Mail end-to-end encrypted.
The recovery trade
Because Apple does not hold the keys, you recover access with your device passcode, a recovery contact or a personal recovery key. If you lose all of those, nobody at Apple can restore the data.
That is the real decision. The setting protects you from a server side breach or legal demand on Apple, and it moves the burden of recovery to you.
A decision guide
Turn it on if:
- Your photos, notes and backups hold material you would not want exposed in a cloud breach
- You are willing to store a recovery key in a safe place and name a trusted recovery contact
- All your Apple devices can update
Wait if:
- An older device you still need cannot update
- You have not yet set up a recovery plan
- You depend on iCloud.com web access daily. It is off by default under the feature, though you can enable it.
Steps
- Update every Apple device.
- Set a recovery contact and create a recovery key.
- Store the key in a place that is not on the devices, such as a sealed envelope with other important documents.
- Enable the setting in your Apple Account settings.
- Test by checking that a second device still signs in.
Pair this with a plan for your estate. Apple's legacy contact feature has its own limits, covered in our legacy contact post.
Quick check
Does Advanced Data Protection encrypt my iCloud Mail end to end?
No. Apple lists iCloud Mail, Contacts and Calendars as outside end-to-end encryption under the feature.
Can Apple recover my data if I lose everything?
No. Apple does not hold the keys, so you need a device passcode, a recovery contact or a personal recovery key.
Sources
Last reviewed: 19 October 2026.
