Apple
Apple Advanced Data Protection Explained (and What It Means for Your Notes)
What Apple Advanced Data Protection encrypts, what it leaves out, how to turn it on without locking yourself out, and what it changes for iCloud notes.
Quick answer: Advanced Data Protection (ADP) is an opt-in iCloud setting that makes most of your iCloud data, including Notes, Photos, iCloud Drive and iCloud Backup, end-to-end encrypted, so only your trusted devices hold the keys. Apple says it covers 25 data categories versus 15 by default. Mail, Contacts and Calendars are not included. The tradeoff: account recovery becomes your job.
What does Advanced Data Protection change?
ADP changes who holds the keys. iCloud always encrypts data in transit and on Apple's servers, but under standard protection Apple holds the keys for most categories and can decrypt them, for example to help you recover your account or to answer a valid legal request. With ADP on, the keys for those categories exist only on your trusted devices.
Apple introduced ADP with iOS 16.2 in December 2022. The additions that matter most:
- iCloud Backup, historically the easiest way into the contents of an iPhone.
- Photos, your whole library.
- Notes, including attachments.
- iCloud Drive, your documents.
- Reminders, Safari bookmarks, Voice Memos and Wallet passes.
What ADP does not change: iCloud Mail, Contacts and Calendars stay under standard protection, because they have to work with the global email system and with CalDAV and CardDAV servers that do not support end-to-end encryption.
| Category | Without ADP | With ADP |
|---|---|---|
| iCloud Backup | Apple holds the keys | End-to-end encrypted |
| iCloud Drive | Apple holds the keys | End-to-end encrypted |
| Photos | Apple holds the keys | End-to-end encrypted |
| Notes | Apple holds the keys (locked notes add a password layer) | End-to-end encrypted |
| Reminders | Apple holds the keys | End-to-end encrypted |
| Safari bookmarks | Apple holds the keys | End-to-end encrypted |
| Voice Memos | Apple holds the keys | End-to-end encrypted |
| Passwords, Health | End-to-end encrypted | End-to-end encrypted |
| iCloud Mail | Apple holds the keys | Unchanged, Apple holds the keys |
| Contacts | Apple holds the keys | Unchanged, Apple holds the keys |
| Calendars | Apple holds the keys | Unchanged, Apple holds the keys |
Source: Apple's iCloud data security overview (support.apple.com/102651), checked October 2026. Apple updates the list, so check it before relying on a specific category.
How do you turn on ADP without locking yourself out?
Go to Settings, tap your name, then iCloud, then Advanced Data Protection. Before it can be enabled, Apple requires a recovery contact or a recovery key, and every device on your account must be updated. Set up both recovery options, because Apple cannot rescue end-to-end encrypted data if you lose access.
- Set up a recovery contact. Pick someone you trust who has their own Apple device.
- Generate and print the recovery key. Apple gives you a 28-character key. Keep it on paper in two separate places. Do not photograph it or save it in iCloud Drive.
- Update every Apple device. ADP needs iOS 16.2, iPadOS 16.2, macOS 13.1 or later on every device signed in to your account. A forgotten old iPad will block it until you update or remove it.
- Decide on web access. With ADP, iCloud.com access to your data is off by default. You can turn it on, which gives the browser and Apple temporary access to the keys for that session.
- Enable ADP and follow the prompts. Your devices then move your existing data to the new keys.
What does ADP not protect?
ADP protects data in iCloud, not on your phone. It leaves Mail, Contacts and Calendars under Apple-held keys, it does not cover some kinds of sharing, and it does nothing if someone unlocks your iPhone. Think of it as iCloud key custody, one half of a privacy setup, not the whole thing.
- iCloud Mail stays readable to Apple under standard protection.
- Some sharing.Shared notes and shared folders stay end-to-end encrypted only if every participant has ADP on. iWork collaboration, Shared Albums and “anyone with the link” sharing are not end-to-end encrypted.
- Device-level access. On an unlocked iPhone, data is already decrypted. ADP does not replace a strong passcode and Face ID.
- Regional availability. Apple stopped offering ADP to new users in the United Kingdom in 2025, so not everyone can turn it on.
How does ADP fit with Apple Notes and Secure Notes?
ADP and a separate notes app solve different problems. ADP decides who can decrypt your iCloud data. An app lock decides who can open your notes on a phone that is already unlocked. Without ADP, iCloud Notes are readable by Apple; with it, they are not. Neither stops someone holding your unlocked phone.
Apple Notes lets you lock individual notes with a password or your device passcode, and the Apple Notes encryption status guide explains each tier. Secure Notes adds a different set of protections on top of iOS: an app-wide passcode and Face ID lock, separate locks for notes and folders, a decoy PIN (Pro) that opens a harmless notebook, and the option to hide the app from the app switcher (Pro).
Be clear on what Secure Notes for iPhone does not do: it does not add its own encryption to notes. Notes sit on the device under iOS Data Protection, and optional sync (Pro) goes to your own private iCloud database through CloudKit, never to a PixelPort server. We do not claim those synced copies are end-to-end encrypted, with or without ADP, so for your most sensitive notes you can simply leave sync off. The app's Pro Encrypted Backup file (version 3.8.1 and later) is encrypted by the app with AES-256-GCM and your password, so a backup you keep offline stays private regardless of iCloud settings.
The practical setup in 2026: turn on ADP if it is available to you, keep a strong device passcode, and use an app lock for the notes that need their own boundary. Compare the options in Secure Notes vs Apple Notes, or see secure notes apps that sync with iCloud.
Frequently asked: Apple Advanced Data Protection
What does Apple Advanced Data Protection actually protect?
Advanced Data Protection raises the number of end-to-end encrypted iCloud data categories from 15 to 25, according to Apple. The main additions are iCloud Backup, iCloud Drive, Photos, Notes, Reminders, Safari bookmarks, Voice Memos and Wallet passes. iCloud Mail, Contacts and Calendars stay under standard protection, with keys held by Apple.
Is Advanced Data Protection worth turning on?
For most people who keep sensitive data in iCloud, yes. It removes Apple's ability to decrypt your backups, photos and notes. The cost is responsibility: Apple can no longer recover that data for you, so you must set up a recovery contact or a recovery key before you can turn it on, and keep them safe.
What happens if I lose my recovery key?
If you still have a trusted device or a recovery contact, you can regain access. If you lose your trusted devices, your recovery key and your recovery contact, Apple cannot decrypt your end-to-end encrypted data and it is gone. Set up both a printed recovery key and a recovery contact so one failure is not fatal.
Does ADP encrypt Apple Notes?
Yes. With Advanced Data Protection on, Notes in iCloud is end-to-end encrypted, with keys held only on your trusted devices. Without ADP, Notes uses standard protection: encrypted in transit and on Apple's servers, but with keys Apple holds. Locked notes get an extra layer either way, encrypted with your notes password or device passcode.
Do I need a recovery contact or key to use ADP?
Yes. Apple requires at least one recovery contact or a recovery key before Advanced Data Protection can be turned on, because Apple will not be able to help you recover end-to-end encrypted data. All your Apple devices must also run iOS 16.2, iPadOS 16.2, macOS 13.1 or later, or be removed from your account.
Why isn't Advanced Data Protection on by default?
Because it moves account recovery from Apple to you. Many people forget passwords and lose devices, and with ADP Apple cannot restore their photos or backups. Apple also notes that it is unavailable in some regions: it stopped offering ADP to new users in the United Kingdom in 2025. So it stays an opt-in setting.
Does ADP protect notes in third-party apps like Secure Notes?
It depends on how each app stores its data in CloudKit, and Apple decides what ADP covers. Secure Notes for iPhone syncs (Pro) to your private iCloud database, never to a PixelPort server, but we do not claim those synced notes are end-to-end encrypted. For sensitive notes, keep sync off or keep a password-encrypted backup (version 3.8.1 and later) offline instead.
Keep reading
Related guides
Apple Notes
Is Apple Notes end-to-end encrypted?
The three-tier answer: standard, locked notes and ADP.
iCloud
Is iCloud safe for sensitive notes?
What iCloud encrypts, who holds the keys, and when that matters.
Comparison
Secure Notes vs Apple Notes
Where Apple Notes wins, where Secure Notes helps, and what ADP changes.
