Is Cloud Photo Storage Safe? What the Policies Say
Cloud photo storage is safe from strangers for most people, but it is not private from the provider by default. Apple and Google both say they can read or analyse what you store, unless you change settings.
Try Cryptile free: join the beta on TestFlight
What do I need to know?
- "Encrypted" usually means the provider holds the key. Your photos are protected from outsiders, not from the company.
- iCloud can be end-to-end encrypted. You have to turn on Advanced Data Protection yourself.
- Shared albums are a gap. Apple says Shared Albums do not support Advanced Data Protection.
What does Apple say about iCloud Photos?
Apple says iCloud data is "encrypted in transit and stored in an encrypted format at rest". Under standard data protection, Apple holds the keys for Photos. That is how Apple can help you recover your account.
Advanced Data Protection has been available since iOS 16.2. It extends end-to-end encryption to 25 categories, including Photos, Notes and iCloud Backup. Apple's warning: if you lose access to your account, "Apple will not have the encryption keys to help you recover it."
Source: Apple, iCloud data security overview.
What does Google's privacy policy say?
Google's privacy policy says it collects "photos and videos you save". It also says: "We use automated systems that analyze your content". The stated purposes include tailored search results and personalised ads.
It also says Google shares information to respond to "legal process, or enforceable governmental request."
Source: Google Privacy Policy.
So is cloud storage safe?
It depends on what you are protecting against.
- A lost or broken phone: cloud storage is the best protection you have.
- A random attacker: account security matters most. Use two-factor authentication and a unique password.
- The provider, a breach or a legal request: only end-to-end encryption, where you hold the key, keeps photos unreadable.
How do I make cloud photos more private?
- On iCloud, turn on Advanced Data Protection. Read Apple's recovery warning first.
- Keep private photos out of shared albums. They stay under standard protection.
- Keep the most private photos out of the photo library. Use an app that encrypts them on your device before anything uploads.
Our guide to whether Apple can see your iCloud Photos goes deeper on step 1. For step 3, see do photo vault apps back up to iCloud?
What this doesn't protect against
No cloud setting helps if someone gets into your unlocked phone. End-to-end encryption does not stop a recipient from saving a photo you sent. Policies change, so read the current version before relying on any of this. If you lose your only key, end-to-end encrypted data cannot be recovered.
Do it with Cryptile
Cryptile encrypts each file on your device with AES-256-GCM before its encrypted iCloud backup uploads anything. There is no account, no server, and the developer never holds your keys.
Cryptile is free for up to 2 vaults, 100 photos and 10 videos in total. Plus removes the limits for $19.99 a year (7-day free trial) or $39.99 once.