Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
In January 2025 the British Home Office sent Apple a secret notice under the Investigatory Powers Act. Reporting describes it as requiring the capability to access data protected by Advanced Data Protection — the setting that extends end-to-end encryption to iCloud backups, photos and files, which Apple itself cannot normally read.
On 21 February 2025 Apple withdrew the feature for British users rather than build the access. Nineteen months later it is still unavailable here, and no court has ruled on whether the demand was lawful.
What a Technical Capability Notice Is
A power under section 253 of the Investigatory Powers Act 2016, which allows the Home Secretary to require a communications provider to maintain the ability to access material it holds — the statute our UK legality page describes from the user’s side rather than the company’s.
The notices are secret by law. The Home Office will neither confirm nor deny that one exists, and the statute can forbid the recipient from saying so — which is why every account of this case, including ours, rests on reporting rather than on the document.
⚠️ So the shape of the story is unusual. Everything that has happened is public, and nobody outside the case has ever seen the document it all concerns.
The word technical in the name misleads. Reporting describes the notice as carrying no technical instructions at all — an order to provide access, rather than a specification for how.
How It Has Gone
February 2025: Apple removes Advanced Data Protection for new British users, and gives existing users time to switch it off themselves.
March 2025: Apple files at the Investigatory Powers Tribunal, the only body that hears these cases. The tribunal schedules a closed hearing.
7 April 2025: the tribunal publishes a judgment refusing the government’s request that nothing at all about the case be public, noting how much had already been reported.
July 2025: the tribunal orders the government to agree a set of facts with Apple, so that a seven-day hearing can proceed in open rather than in secret. It also refuses an application by WhatsApp to intervene.
August 2025: after intervention from the United States administration, the government withdraws the worldwide element of the demand. Coverage widely called that a resolution.
⚠️ It was not. In October the Home Office issued a replacement notice, aimed at the encrypted data of British users specifically. The tribunal then dismissed Apple’s first challenge for a change in circumstances — not on the merits, because the notice it contested no longer existed.
August 2026: Apple confirms a fresh complaint against the new notice. Civil liberties organisations are running parallel challenges to the regime itself.
What Has Actually Been Settled
The case may be heard in public. That outcome was genuinely contested: the government argued for total secrecy and lost.
The first notice is gone. External pressure removed it; no court struck it down.
⚠️ And nothing else. Whether the government used the power lawfully, whether the replacement notice stands, what it requires, and when British users get the feature back all remain open.
The practical position has not moved in nineteen months. Advanced Data Protection remains unavailable in the United Kingdom and available everywhere else — the same year Britain became a VPN market for unrelated reasons.
Both Arguments, As Their Authors Put Them
The government’s case is investigative access. Its stated position is that the capability is necessary for national security, counter-terrorism and investigations into child sexual abuse, and that encryption without lawful access obstructs them.
Apple’s case is that the access cannot be limited. It has said it will not build a back door or master key, on the reasoning that a capability accessible to one authority is a capability that exists.
The civil liberties case is about scope and secrecy. Privacy International’s legal director described the demand as unacceptable and disproportionate, and argued that no single country should be able to remove a protection people rely on worldwide.
⚠️ We take no position. Both the purpose and the objection are serious, and the tribunal has not chosen between them — which is the honest summary rather than a hedge.
Why This Is Not a VPN Question
The dispute is about stored data, not traffic. A VPN encrypts the journey between your device and the network; iCloud encryption governs what sits on a server afterwards — two different layers entirely.
No provider, server or country setting changes it. Connecting through Panama does not alter the terms under which Apple holds a backup made from your phone.
⚠️ It is the same distinction as the European scanning debate. Both concern the ends of a conversation rather than its middle, and the middle is all a tunnel covers.
But unlike that debate, there is something to do here. A demand for access to cloud storage only matters if your data is in cloud storage.
What Actually Helps
Turn off cloud backup. On an iPhone: Settings, your name, iCloud, then switch off iCloud Backup, Photos, iCloud Drive and Messages in iCloud. Five minutes, and it settles most of the question.
Check applications individually. Messaging apps keep their own cloud copies, separately from the system setting, and those are the ones people forget.
Prefer a local encrypted backup to a computer or a drive you hold yourself. Less convenient, and entirely outside anyone’s notice.
⚠️ And do not buy a VPN for this. It protects transit and this is storage, so several free measures do more here than any subscription.
Why It Matters Beyond Apple
This is the first significant test of the power. If the tribunal upholds a notice scoped to one country’s residents, that answers a question for everyone: whether such demands can be split by jurisdiction at all.
The 2023 amendment widened the reach of these notices to companies outside the United Kingdom, which is what makes the geography argument consequential rather than technical.
⚠️ And the pattern is not British alone. Switzerland has proposed obligations reaching VPN providers, Sweden’s framework reaches the device before encryption, and the European file is separately unresolved.
The providers who fare best under this are the ones holding least. A capability that does not exist cannot be compelled, which is the argument behind Mullvad’s account numbers and RAM-only infrastructure generally.
How We Research
This page draws on Privacy International’s published case record for the tribunal’s procedural orders, the April 2025 judgment on secrecy, the July 2025 direction to agree facts and the refusal of WhatsApp’s intervention, on The Register and Reuters reporting for the January 2025 notice and Apple’s February withdrawal, and on later reporting for the August 2025 withdrawal of the worldwide demand and the replacement notice that followed. Privacy International is a litigant in the case, which we note because its account is a party’s account. The notice itself has never been published and Apple is legally prevented from confirming it exists, so everything here is reporting rather than primary text, and we have said so in the article as well. We take no position on the policy. Our method lives on the About Us page.
Apple and the UK Order FAQ
No. Apple withdrew it for new British users on 21 February 2025, and existing users were given a period to switch it off themselves. It remains unavailable in the United Kingdom and available in other countries, and that has not changed in nineteen months.
It withdrew the original notice in August 2025, after intervention from the United States administration, and issued a replacement in October aimed at British users specifically. Reporting in August 2025 described a resolution; the principle was unchanged and only the geographic scope moved.
No. The Investigatory Powers Tribunal has not decided the lawfulness question. Its April 2025 public judgment concerned secrecy, and Apple’s first challenge was dismissed for a change in circumstances after the notice it contested was withdrawn. A fresh complaint was filed in August 2026.
No. A VPN encrypts traffic between your device and the network. Whether a cloud provider can read a backup it stores is a question about that provider’s encryption, not about the route your data took. Switching off cloud backup is the step that matters.
A power under section 253 of the Investigatory Powers Act 2016 allowing the Home Secretary to require a provider to maintain the ability to access material. The notices are secret, the government will neither confirm nor deny them, and recipients can be prohibited from disclosing their existence.
The Verdict
A company removed a security feature for one country rather than weaken it, and the feature is still gone. That is the only part of this with a settled answer.
The August 2025 headlines were premature. A worldwide demand became a national one, the first legal challenge fell away for procedural reasons, and the question of whether any of it is lawful remains open after nineteen months.
And the useful response costs nothing. An access demand against cloud storage reaches only what is in cloud storage — which is a setting on your phone, not a product you buy.