Apple vs UK Government: Inside the Second Legal Battle Over iCloud Encryption

How the Dispute Unfolded: A Timeline

• January 2025: The UK Home Office secretly issued a TCN demanding Apple build a backdoor into its end-to-end encrypted Advanced Data Protection (ADP) feature. The order originally applied globally .
• February 2025: Rather than comply, Apple removed ADP for all UK users — meaning iCloud backups in the UK could no longer be end-to-end encrypted. Apple also filed its first legal challenge at the IPT .
• April 2025: The IPT publicly confirmed the dispute, rejecting the government's bid to keep the case entirely secret. Apple was revealed to be appealing the order .
• August 2025: After strong US pushback — including a public statement from US Director of National Intelligence Tulsi Gabbard — the Home Office withdrew the original global TCN .
• September–October 2025: The UK government issued a new, narrower TCN that limited the demand to encrypted data belonging to British users only . The IPT then dismissed Apple's original appeal as moot since the first order was withdrawn .
• July 2026: Apple filed its second legal challenge at the IPT over the revised demand .

The Narrowed Scope: UK-Only Backdoor?

The key difference between the two orders is geographic scope. The original TCN demanded blanket access to encrypted iCloud data from users worldwide. The revised version, issued in September 2025, is supposedly confined to UK-based users' data .

However, critics including the Electronic Frontier Foundation (EFF) argue that a backdoor cannot be reliably limited by geography — it would necessarily weaken the cryptographic system for everyone . As security experts have pointed out, building a backdoor that only works for UK users is technically infeasible; any vulnerability can be exploited by actors anywhere in the world.

Arguments: Apple vs the UK Government

Apple's position:

• Forcing a backdoor into end-to-end encryption would break security for all users. A backdoor weakens encryption globally and creates vulnerabilities that could be exploited by malicious actors .
• The demand violates Apple's longstanding commitment to user privacy. The company has stated it has "never built a backdoor" into its products and will not do so .
• Even a "UK-only" backdoor is technically infeasible and still threatens the security architecture of the entire iCloud system .

UK government's position:

• The demand is justified under the Investigatory Powers Act for national security and law enforcement purposes. The government says it needs access to evidence related to serious crimes, terrorism, and child sexual abuse material .
• The narrowed scope was offered as a compromise to address US concerns about extraterritorial overreach .
• The Home Office argues tech companies should be able to comply with authorized legal requests while maintaining overall security. It has not publicly confirmed or denied the existence of the notices, citing operational matters .

Broader Implications: A Global Test Case

Precedent for encryption: This case is widely seen as a test of whether any democratic government can compel a tech company to break end-to-end encryption. If the UK succeeds, other nations — including authoritarian regimes — may follow with similar demands .

Technical impossibility of geographic limits: The EFF and other security experts argue that creating a backdoor for UK users alone is not technically realistic. A cryptographic backdoor cannot be confined to one country's users; it would weaken the system globally .

US-UK diplomatic friction: The original global demand triggered rare public intervention from US intelligence officials, revealing significant tension between US tech companies' security standards and UK surveillance powers .

Business impact: Apple's decision to remove ADP entirely for all UK users — rather than comply — means that even British users who want maximum security have lost access to end-to-end encrypted iCloud backups .

Civil society challenges: Privacy International and Liberty have also brought legal challenges against the TCN, arguing it violates human rights law .

What Happens Next

The IPT is expected to hold a public hearing in 2026 to determine the legality of the government's demand . The outcome could reshape the balance between surveillance powers and encryption rights in the UK and beyond. If the government loses, it may signal limits on what democratic states can demand from tech companies. If it wins, encryption as users know it could be fundamentally altered.

Either way, this case has already changed the landscape: UK iCloud users have lost a security feature they once had, and the question of who holds the keys to encrypted data is now at the center of a high-stakes international legal battle.