# iCloud Mail privacy rating

Email service included with every Apple Account, with @icloud.com addresses and custom domains for iCloud+ subscribers.

## Summary

iCloud Mail scores 47 out of 100 (grade D) on the email providers criteria. It meets 8 of 19 criteria: no trackers or telemetry, no ads or data sales, transparency report, tells users about requests, TLS configuration, security headers, open protocols and custom domains. It partly meets encrypted mailbox storage, IMAP support and SMTP submission. It does not meet open source, independent audit, end-to-end encryption, sign up without personal data, POP3 support, mail transport security, Sender Rewriting Scheme and ARC sealing. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.

- Website: https://www.icloud.com/mail
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Home page trackers: none found
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Also rated: [Hide My Email](https://privacyratings.com/email-forwarding/hide-my-email/) (Email forwarding and aliases), [Apple Mail](https://privacyratings.com/email-clients/apple-mail/) (Email clients), [Safari](https://privacyratings.com/browsers/safari/) (Browsers), [Apple App Store](https://privacyratings.com/app-stores/apple-app-store/) (App stores), [Apple Passwords](https://privacyratings.com/password-managers/apple-passwords/) (Password managers), [FileVault](https://privacyratings.com/file-encryption/filevault/) (File encryption), [iMessage](https://privacyratings.com/messengers/imessage/) (Messengers), [FaceTime](https://privacyratings.com/video-calls/facetime/) (Video calls), [iOS](https://privacyratings.com/mobile-operating-systems/ios/) (Mobile operating systems), [macOS](https://privacyratings.com/desktop-operating-systems/macos/) (Desktop operating systems), [Spotlight](https://privacyratings.com/launchers/spotlight/) (App launchers), [Apple Notes](https://privacyratings.com/notes/apple-notes/) (Notes), [Apple Journal](https://privacyratings.com/journaling/apple-journal/) (Journaling apps), [Apple iWork](https://privacyratings.com/office-suites/apple-iwork/) (Office suites), [QuickTime Player](https://privacyratings.com/screen-recording/quicktime-player/) (Screenshots and screen recording), [Apple Books](https://privacyratings.com/ebook-readers/apple-books/) (Ebook readers), [Apple Dictation](https://privacyratings.com/speech-to-text/apple-dictation/) (Dictation and transcription), [iCloud Drive](https://privacyratings.com/cloud-storage/icloud-drive/) (Encrypted cloud storage), [Apple Maps](https://privacyratings.com/maps/apple-maps/) (Maps and navigation), [SwiftUI](https://privacyratings.com/app-frameworks/swiftui/) (Cross-platform app frameworks), [Apple Home](https://privacyratings.com/smart-home/apple-home/) (Smart home), [Apple Watch](https://privacyratings.com/wearables/apple-watch/) (Wearables and health), [Apple Health Cycle Tracking](https://privacyratings.com/period-trackers/apple-health-cycle-tracking/) (Period trackers), [Apple Music](https://privacyratings.com/music-streaming/apple-music/) (Music streaming), [iCloud Photos](https://privacyratings.com/photo-management/icloud-photos/) (Photo management)
- Grade: D (47/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | Yes | Analytics are only shared with Apple with consent, and iCloud.com loads no third-party trackers. | https://www.apple.com/legal/privacy/data/en/device-analytics/ |
| No ads or data sales | Yes | Funded by device sales and iCloud+ subscriptions. No ads, and Apple states that it does not sell personal data. | https://www.apple.com/legal/privacy/en-ww/ |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | Yes | Apple publishes counts of government and private party requests twice a year. | https://www.apple.com/legal/transparency/ |
| Tells users about requests | Yes | Apple notifies customers when their account information is sought, unless prohibited by law or in emergencies. | https://www.apple.com/legal/privacy/law-enforcement-guidelines-us.pdf |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=www.icloud.com&hideResults=on |
| Security headers | Yes | Grade A+ (130/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.icloud.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encryption | No | iCloud Mail is not end-to-end encrypted, even with Advanced Data Protection. S/MIME works in Apple Mail. | https://support.apple.com/en-us/102651 |
| Encrypted mailbox storage | Partial | Mail is encrypted on the server with keys Apple holds. | https://support.apple.com/en-us/102651 |
| Open protocols | Yes | IMAP and SMTP work with other apps. POP3 is not supported. | https://support.apple.com/en-us/102525 |
| Custom domains | Yes | Available with any iCloud+ subscription. | https://support.apple.com/en-us/102540 |
| Sign up without personal data | No | Creating an Apple Account asks for a birth date, an email address and a phone number. | https://support.apple.com/en-us/108647 |
| Email security standards | Not tested yet | Not tested yet. |  |
| IMAP support | Partial | imap.mail.me.com:993 (implicit TLS). IMAP4rev1 advertised, no IDLE before login. |  |
| POP3 support | No | Not offered. |  |
| SMTP submission | Partial | smtp.mail.me.com:587 (STARTTLS). SMTPUTF8, 8BITMIME, PIPELINING and AUTH advertised. |  |
| Mail transport security | No | Passes: SPF, DMARC quarantine. Missing: MTA-STS missing, TLS-RPT, DNSSEC, DANE none. |  |
| Sender Rewriting Scheme | No | No published documentation on SRS for forwarded mail. |  |
| ARC sealing | No | No published documentation on ARC signing or validation. |  |

Source: https://privacyratings.com/email-providers/icloud-mail/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/icloud-mail.md