Apple contests renewed UK order seeking access to encrypted iCloud data
Apple is challenging another UK government demand for access to encrypted user data, the Financial Times reported. The company has reportedly filed a complaint with the Investigatory Powers Tribunal, the court that hears cases involving government surveillance.
The dispute concerns a “technical capability notice” issued in October. Such notices are secret legal orders that can require access to user data even when it is encrypted.
Why Advanced Data Protection is central
The order affects iCloud backups secured with Advanced Data Protection, or ADP. With ADP enabled, those backups are end-to-end encrypted and can be accessed only by the customer. Apple itself cannot retrieve the protected content.
Critics therefore describe this type of demand as equivalent to requiring a backdoor into encrypted cloud backups. The issue is not simply whether Apple should hand over data it holds, but whether it would have to create a technical means of reaching information that its current encryption design keeps beyond the company’s access.
The challenge also places Apple’s privacy commitments alongside its wider legal disputes, including Apple’s commercial-secrets litigation with OpenAI, while the UK proceeding is specifically focused on government surveillance powers and encrypted iCloud backups.
A second confrontation within a year
The latest case follows a similar conflict in early 2025, when London issued a secret order demanding access to encrypted iCloud backups. That order was later dropped after intervention by the Trump administration.
Apple responded to the first order by removing UK users’ ability to activate Advanced Data Protection. The UK government then issued a second order in October, and that is the notice Apple is now reportedly contesting before the Investigatory Powers Tribunal.
Apple did not respond to TechCrunch’s request for comment. The report therefore establishes the filing and the sequence of the two orders, but does not provide the company’s legal arguments or the remedy it is seeking from the tribunal.
What businesses should take from the case
For organisations using cloud backups, the dispute highlights the need to distinguish ordinary provider-side encryption from end-to-end protection that excludes the service provider from access. That distinction can determine whether a provider can comply directly with a demand or faces pressure to alter a product’s technical capabilities.
Businesses should document which services hold sensitive information, whether end-to-end encryption is available in every operating market, and what happens if a feature is withdrawn locally. Procurement, security and legal teams can then assess data residency, recovery and continuity plans against the actual encryption options available to users.