iCloud Photos is convenient, but its encryption depends on a setting most people have never changed. Here is what Apple actually encrypts, who holds the keys, and what that means for your private photos.
Standard Data Protection: the default
By default, every Apple Account uses Standard Data Protection. Your iCloud Photos are encrypted in transit and stored encrypted on Apple's servers. However, Apple holds the encryption keys. That means Apple can decrypt your photos if required, for example to comply with a legal request or to help you recover your account.
This is not a weakness in the technical sense — it is a design choice that makes account recovery possible. But it does mean a third party with the right legal authority, or an attacker who compromises Apple's key infrastructure, could in theory access your photos. Apple's iCloud data security overview describes this in detail.
Advanced Data Protection: end-to-end encryption
Since iOS 16.2, Apple offers Advanced Data Protection. When you turn it on, iCloud Photos is end-to-end encrypted: only your trusted devices hold the keys. Apple cannot decrypt your photos, even if asked. The trade-off is that if you lose access to all your devices and your recovery key or recovery contact, your photos are gone.
Advanced Data Protection raises the number of end-to-end encrypted data categories from 15 to 25. Photos, Notes, iCloud Backup and iCloud Drive all move to end-to-end encryption. You enable it in Settings › Apple Account › iCloud › Advanced Data Protection.
What stays outside end-to-end encryption
iCloud Mail, Contacts and Calendars remain under Standard Data Protection even with Advanced Data Protection, because they rely on open protocols (IMAP, CalDAV, CardDAV) that do not support it.
Certain metadata — file sizes, checksums, modification dates — stays encrypted with keys Apple holds, even with Advanced Data Protection enabled. Apple uses this metadata for deduplication and storage optimization without accessing your actual files.
Shared content is end-to-end encrypted only when every participant has Advanced Data Protection on. iWork collaboration and Shared Albums always use Standard Data Protection.
When a local vault adds a layer
A local photo vault like PureVault keeps selected photos encrypted on your device, never in a cloud. The encryption keys stay in your iPhone's Keychain and Secure Enclave. Nobody else stores your private photos, and no account recovery process can expose them. That is a different model from iCloud, and it is useful if your main concern is that certain photos should not exist on any remote server at all.
The trade-off: a local vault is not a backup. You are responsible for keeping the vault safe through export or encrypted transfer before you reset or replace your iPhone.
