Apple Will Check Public iCloud Links for Harmful Content (11/05/2026)

Most people who share an iCloud folder with a link think of it as sending a file to a colleague. Apple’s new support document treats it as publishing, and says anything shared that way will be checked for “harmful content,” a term it has not defined. The practical point for any business that uses iCloud is that a public link already carries less protection than staff assume, and from December it also carries review by Apple.

Top 5 Critical Privacy Alerts

1. Apple Will Check Content Shared Through Public iCloud Links

Apple said that starting with iOS, iPadOS, macOS, and visionOS 27.3 later in December, “items shared using Anyone with the Link will be checked by Apple for harmful content,” covering photos in iCloud Photos and files in iCloud Drive, per The Hacker News and The Register. Apple has not defined harmful content or said how the checks work, and content found to be harmful can be removed, the account disabled, or law enforcement involved. Sharing by public link already disables end-to-end encryption for that content, even when Advanced Data Protection is on.

Operator Note: Tell staff that a public iCloud link is not a private transfer. Client files and anything sensitive belong in a sharing service your organization controls, with named recipients.

2. The UK Plans Facial Recognition for General Immigration Enforcement

The Home Office plans to use live facial recognition for “general immigration enforcement,” with watchlists that could include non-criminal breaches such as visa overstays, as reported by Liberty Investigates and the Guardian, per Biometric Update. The Biometrics and Surveillance Camera Commissioner says he was not consulted and that immigration use falls outside his remit, a day after the government promised a single oversight body for police facial recognition, which we covered yesterday.

3. The Creator of an AI Fake ID Site Explains How It Worked

Yuriy Nazarenko, who created OnlyFake, a site that let anyone generate realistic fake identity documents with AI, described the operation’s rise and fall, including the point when North Koreans came calling, to 404 Media. Generated documents like these are exactly what photo-of-an-ID checks, still common in customer onboarding, have to catch.

Operator Note: If your onboarding accepts a photographed ID as proof of identity, assume it can be faked convincingly and cheaply. Pair it with a liveness check or a source you can verify independently.

4. States Keep Adding Rules on Location Data and Data Brokers

States adopted more targeted privacy requirements in 2026, including restrictions on precise geolocation and sensitive data and expanded obligations for data brokers, which can apply even to businesses that fall outside the broad consumer privacy laws, per a Coblentz Patch Duffy & Bass summary via PogoWasRight.

5. Delaware Tightens Its Breach Notification Law

Delaware’s HB 381, signed September 2 and effective immediately, adds a 60-day notice requirement to the state attorney general and changes other parts of its breach notification statute, with implications for healthcare providers, per a Saul Ewing analysis via PogoWasRight.

Additional Privacy Alerts

Identity & Biometrics

• Paravision will verify passport photos and detect manipulated images for the State Department: Its technology will support the Bureau of Diplomatic Technology’s photo checks for passport and visa applications. Biometric Update

Regulatory Fines & Enforcement Actions

• The FTC and 22 states unredact their Amazon advertising complaint: New details describe alleged practices that secretly inflated prices in Amazon’s search ad auction. FTC

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.