Apple’s Advanced Data Protection (ADP) for iCloud is a powerful feature that enhances the security of your data by extending end-to-end encryption to 10 additional data categories, beyond the core 14.
ADP has been in the news lately and many people are starting to wonder if they should enable it… However, turning ADP on comes with both benefits and trade-offs…
This blog post – and the accompanying video below – explore the pros and cons of enabling ADP and provide a step-by-step guide to turning it on.
If you think you are at risk of being hacked, you should also read about the very real risks of SIM swapping and how to reduce the risk of being the victim of such an attack.
What Is Advanced Data Protection (ADP)?
ADP is an optional feature that increases the number of iCloud data categories protected by end-to-end encryption.
So, if you’re an iCloud user, this means your data is encrypted on your device and can only be decrypted on your trusted devices with an encryption key that you have and/or by utilizing a trusted contact.
With ADP turned on, if you lose your device Apple cannot help you recover it because Apple will not have access to your encryption keys… Thus, by turning on ADP you are removing Apple’s access to your data, and thereby making this data secure from breaches, unauthorized access of Apple’s servers or even a court order from a third party, such as a governmental regime.
Standard Data Protection by Default
Note that by default, Apple provides end-to-end encryption for 14 types of data.
Also, it should be noted that 5 types of data (including Mail, Contacts, and Calendars) are not end-to-end encrypted because of how they function with other 3rd party services… These services are provided with Standard Data Protection.
The first 14 data types below are included with Apple’s “Standard Data Protection”… And the data types 15-24 below (in bold) are end-to-end encrypted with ADP enabled:
- Passwords & Keychain
- Health data
- Journal data
- Home data
- Payment information
- Apple Card transactions
- Apple Maps data
- Quick Type Keyboard data
- Safari history, tab groups and iCloud tabs
- Screen time
- Siri information
- Wi-Fi passwords
- W1 and H1 Bluetooth keys
- Memoji
- iCloud Backup
- iCloud Drive
- Photos
- Notes
- Reminders
- Safari Bookmarks
- Siri Shortcuts
- Voice Memos
- Wallet Passes
- Freeform Data
Thus, with ADP enabled, you get 24 data categories included in end-to-end encryption beyond the core 14 categories already encrypted by default, as described in the video below, such as Health data, Wi-Fi passwords, Home data, Keychain passwords, etc.
What about iMessage? Is iMessage end-to-end encrypted?
iMessage End-To-End Encryption
iMessage is end-to-end encrypted by default if you don’t have iCloud Backup enabled.
However, if you have iCloud Backup enabled, Apple keeps a copy of your encryption key backed up as well and the key itself is not encrypted… This is to help you recover your data if needed.
If you enable ADP, Apple encrypts this encryption key and provides end-to-end encryption for the backup as well.
Pros & Cons of Advanced Data Protection
There are pros and cons that come with enabling ADP… Whether you choose to do so really comes down to how at risk you believe you are to be the victim of data theft or how sensitive that data is, and how comfortable you are with managing the security information you would need to restore your data if your devices are lost or inaccessible.
Pros of Enabling Advanced Data Protection:
- Enhanced Security: ADP ensures that even if Apple’s servers are breached, your data remains secure because only you hold the decryption keys.
- Privacy from Third Parties: Since Apple cannot access your encrypted data, it also cannot share it with law enforcement or other entities.
- Protection Against Cyber Threats: Hackers cannot decrypt your data even if they gain access to Apple’s servers.
- No Additional Cost: ADP is free for all eligible users with compatible devices running the latest software.
Cons of Enabling Advanced Data Protection:
- No Recovery Assistance from Apple: If you lose your password or recovery methods, Apple cannot help you recover your data because it does not store the encryption keys.
- Device Compatibility Requirements: All devices linked to your Apple ID must be updated to the latest software versions (iOS 16.2/iPadOS 16.2/macOS 13.1 or later). Older devices must be removed from your account.
- Limited Web Access: By default, ADP disables web access to iCloud.com for security reasons. You can re-enable it temporarily, but sessions are limited to one hour.
- Setup Complexity: You must set up at least one recovery method (Recovery Contact or Recovery Key) before enabling ADP, which may feel cumbersome for some users.
- Collaboration Limitations: Shared features like iWork collaboration and Shared Albums in Photos are not fully supported unless all participants have ADP enabled.
How To Turn On Advanced Data Protection
If you decide to enable ADP, there are a few prerequisites…
Before enabling ADP, you must have two factor authentication (2FA) enabled, ensure all your devices are updated to the latest software version of iOS and/or Mac OS and you must set up a recovery method (Recovery Contact or Recovery Key).
To turn on ADP on iPhone or iPad:
- Open the Settings app.
- Tap your name at the top, then select iCloud.
- Scroll down and tap Advanced Data Protection.
- Follow the onscreen instructions to set up Account Recovery.
- Tap Turn On Advanced Data Protection.
To turn on ADP on a Mac:
- Open System Settings, then click your name at the top.
- Select iCloud, then click Advanced Data Protection.
- Set up Account Recovery if prompted.
- Click Turn On.
Should You Enable Advanced Data Protection?
As mentioned above, ADP offers extended security through end-to-end encryption of your data so that no one, not even Apple, can access and make any sense of it.
Thus, turning on ADP is ideal for users who prioritize privacy and security and are confident in managing their own recovery methods. However, if you rely heavily on older devices or shared iCloud features—or if you’re concerned about losing access to your account—ADP may not be suitable for you.
Ultimately, enabling ADP is a personal choice. Even in the cybersecurity world there is not consensus on whether everyone should enable it.
The decision to enable ADP comes down to balancing enhanced security with personal convenience and risk tolerance. If you decide to turn it on, make sure you fully understand how recovery works and keep your recovery methods secure!
