# iCloud Drive privacy rating

Apple's cloud storage for files across Apple devices, Windows and the web. Files are end-to-end encrypted only with the optional Advanced Data Protection setting, which is off by default.

## Summary

iCloud Drive scores 75 out of 100 (grade B) on the encrypted cloud storage criteria. It meets 6 of 8 criteria: no trackers or telemetry, no ads or data sales, transparency report, tells users about requests, TLS configuration and security headers. It partly meets independent audit. It does not meet open source. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.

- Website: https://www.icloud.com/iclouddrive
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web, Windows, macOS, iOS
- Home page trackers: none found
- Category: [Encrypted cloud storage](https://privacyratings.com/cloud-storage/)
- Also rated: [iCloud Mail](https://privacyratings.com/email-providers/icloud-mail/) (Email providers), [Hide My Email](https://privacyratings.com/email-forwarding/hide-my-email/) (Email forwarding and aliases), [Apple Mail](https://privacyratings.com/email-clients/apple-mail/) (Email clients), [Safari](https://privacyratings.com/browsers/safari/) (Browsers), [Apple App Store](https://privacyratings.com/app-stores/apple-app-store/) (App stores), [Apple Passwords](https://privacyratings.com/password-managers/apple-passwords/) (Password managers), [FileVault](https://privacyratings.com/file-encryption/filevault/) (File encryption), [iMessage](https://privacyratings.com/messengers/imessage/) (Messengers), [FaceTime](https://privacyratings.com/video-calls/facetime/) (Video calls), [iOS](https://privacyratings.com/mobile-operating-systems/ios/) (Mobile operating systems), [macOS](https://privacyratings.com/desktop-operating-systems/macos/) (Desktop operating systems), [Spotlight](https://privacyratings.com/launchers/spotlight/) (App launchers), [Apple Notes](https://privacyratings.com/notes/apple-notes/) (Notes), [Apple Journal](https://privacyratings.com/journaling/apple-journal/) (Journaling apps), [Apple iWork](https://privacyratings.com/office-suites/apple-iwork/) (Office suites), [QuickTime Player](https://privacyratings.com/screen-recording/quicktime-player/) (Screenshots and screen recording), [Apple Books](https://privacyratings.com/ebook-readers/apple-books/) (Ebook readers), [Apple Dictation](https://privacyratings.com/speech-to-text/apple-dictation/) (Dictation and transcription), [Apple Maps](https://privacyratings.com/maps/apple-maps/) (Maps and navigation), [SwiftUI](https://privacyratings.com/app-frameworks/swiftui/) (Cross-platform app frameworks), [Apple Home](https://privacyratings.com/smart-home/apple-home/) (Smart home), [Apple Watch](https://privacyratings.com/wearables/apple-watch/) (Wearables and health), [Apple Health Cycle Tracking](https://privacyratings.com/period-trackers/apple-health-cycle-tracking/) (Period trackers), [Apple Music](https://privacyratings.com/music-streaming/apple-music/) (Music streaming), [iCloud Photos](https://privacyratings.com/photo-management/icloud-photos/) (Photo management)
- Grade: B (75/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | Yes | Device and iCloud analytics are only shared with Apple if the user agrees, and no third-party trackers are included. | https://www.apple.com/legal/privacy/data/en/device-analytics/ |
| No ads or data sales | Yes | Funded by iCloud+ subscriptions and device sales, with no ads in iCloud Drive. Apple states it does not sell personal data. | https://www.apple.com/legal/privacy/en-ww/ |
| Independent audit | Partial | Apple's internet services, including iCloud, have yearly ISO 27001 and 27018 certification audits, but only the certificates are public. | https://support.apple.com/guide/certifications/apple-internet-services-security-apc34d2c0468b/web |
| Transparency report | Yes | Publishes counts of government requests for customer data twice a year. | https://www.apple.com/legal/transparency/ |
| Tells users about requests | Yes | Apple notifies customers when their account information is sought by legal process, unless prohibited or in emergencies. | https://www.apple.com/legal/privacy/law-enforcement-guidelines-us.pdf |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=www.icloud.com&hideResults=on |
| Security headers | Yes | Grade A+ (130/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.icloud.com |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/cloud-storage/icloud-drive/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/cloud-storage/icloud-drive.md