Apple's iCloud service is described in Apple's own privacy documentation as collecting broad categories of user content (contacts, calendars, photos, documents, health and app data) to provide backup and sync functionality, with 15 data categories end-to-end encrypted by default and up to 25 protected if the optional Advanced Data Protection feature is enabled. Apple's public record includes a 2014 large-scale account-compromise incident affecting hundreds of iCloud users (attributed in unsealed FBI court filings to credential phishing rather than a systemic breach), a 2025 UK government order that led Apple to withdraw its strongest iCloud encryption option for new UK users rather than build a backdoor, and a distinct corporate and legal arrangement in which iCloud service in China mainland is operated by a separate Chinese company, GCBD, under its own terms. Apple has also faced an €8 million CNIL fine in France over App Store advertising-identifier consent practices, a matter separate from iCloud data handling specifically.
TIMELINE
NO ENTRIES ON FILE YET.
ULTIMATE PARENT
TOOLS WE RECOMMEND
PLUS
RECEIPTS
18 ON FILE
COLLECTION
Apple's Apple Account privacy notice discloses that when a user signs in to enable iCloud and other services, 'certain data, including your contacts, calendars, photos, documents, health, activity, and other app data, will be sent to Apple to store and back up on your behalf.'
Apple's Advanced Data Protection privacy notice states that enabling the feature causes Apple to collect 'limited information related to your use of the feature and information about account recovery,' associated with the user's Apple Account.
Apple discloses that the operation of iCloud for mainland China customers is handled by a distinct, named corporate entity, GCBD (AIPO Cloud (Guizhou) Technology Co. Ltd), rather than by Apple directly, with its own terms and conditions.
Apple's global privacy policy states it covers data handling by 'Apple or an Apple-affiliated company (collectively, "Apple")' without listing the specific affiliated legal entities on that policy page.
Reporting on internal Apple documents describes that Apple moved encryption keys for mainland Chinese iCloud accounts from US-based servers to Chinese data centers around 2018, a change that shifted which country's legal process governs government requests for that account data.
Apple's support documentation discloses that iCloud service for users in mainland China is 'operated by GCBD (AIPO Cloud (Guizhou) Technology Co. Ltd)' and that data stored in iCloud there, including photos, videos, documents and backups, is subject to GCBD's own terms and conditions rather than Apple's global terms.
FBI court documents unsealed in 2015 indicated that almost 600 iCloud accounts were successfully breached in the 2014 'Celebgate' incident, in which intimate photos of celebrities and members of the public were obtained via targeted credential attacks rather than a breach of Apple's core iCloud infrastructure.
In December 2022, France's data protection authority (CNIL) imposed an €8 million fine on Apple Distribution International for collecting App Store advertising identifiers on devices running iOS 14.6 without obtaining user consent, a matter concerning App Store ad targeting rather than iCloud data handling specifically.
In response to a UK government order under the Investigatory Powers Act demanding backdoor access to encrypted iCloud data, Apple withdrew its Advanced Data Protection encryption option for new UK users in 2025 and stated it has 'never built a backdoor or master key to any of our products or services and we never will.'
Apple's iCloud data security overview states that 15 iCloud data categories, including Health and iCloud Keychain passwords, are end-to-end encrypted by default so 'no one else can access' that data, with the number of protected categories rising to 25 if the user separately enables the optional Advanced Data Protection setting.
Apple's Apple Account privacy notice discloses that account and service usage, including an associated phone number, 'will be used with each service, which will generate analytics information that may be used to maintain and improve those services.'