The UK Dropped Its Apple Encryption Order, Then Issued Another

The worldwide backdoor demand was withdrawn under US pressure. A narrower one replaced it, and the secret-order regime is now headed for open court.

State of Surveillance Editorial Team

Glowing digital network connection lines spanning a darkened globe at night, with lit city grids across multiple continents
Photo via Unsplash

TL;DR:

  • The UK backed down on its worldwide demand. After months of US-UK talks, Director of National Intelligence Tulsi Gabbard said on August 19, 2025 that the UK had agreed to drop the order requiring Apple to break end-to-end encryption on iCloud for users globally. The Financial Times reported that Vice President JD Vance pushed for the withdrawal. [1]
  • Then it tried again, smaller. In October 2025 the Financial Times reported the Home Office had issued a fresh order, this time scoped to British residents only. Apple's position did not change: it will not build a backdoor, and Advanced Data Protection stays unavailable to new UK users. [2]
  • The secret-order regime is now in open court. Apple's challenge and a parallel one from Privacy International and Liberty are before the Investigatory Powers Tribunal, set to be heard largely in public on agreed "assumed facts." No final ruling has been announced. [3][6]
  • The government tried to keep the whole case secret. The tribunal refused. [4]
  • The Home Office still will not confirm or deny that any order exists. [1][2]
  • A backdoor scoped to one country still breaks everyone's encryption. The math does not respect borders. That is why a British order is a global problem.

The worldwide order was withdrawn

The original Technical Capability Notice, issued in early 2025 under the Investigatory Powers Act 2016, reportedly told Apple to provide access to end-to-end encrypted iCloud data for users anywhere in the world. By mid-2025 it had become a diplomatic problem. On August 19, 2025, US Director of National Intelligence Tulsi Gabbard announced that the UK had agreed to drop the demand, saying it would have affected the data of American citizens. The Financial Times reported that Vice President JD Vance had intervened to get the "current backdoor order" withdrawn, and President Trump had earlier compared the demand to something "you hear about with China." [1]

The win came with an asterisk. The Home Office would not confirm the order had ever existed, would not say whether it would reinstate the demand if Apple restored encryption, and it stayed unclear whether Apple would bring Advanced Data Protection back to UK users. Gabbard's framing emphasized protecting American citizens, not UK ones. [1]

Then the UK issued a new order

The retreat did not last. In October 2025, the Financial Times reported that the Home Office had served Apple again, this time with an order scoped to British residents rather than the global user base. Apple's answer was the same answer it gave in February 2025: it would refuse to build the capability, and it would keep Advanced Data Protection switched off for new UK users. Apple has said it is "deeply disappointed that our customers in the UK will no longer have the option to enable Advanced Data Protection." The Home Office, again, declined to confirm or deny the order. [2]

How we got here

The chronology is worth keeping straight. In early 2025 the UK served the first Technical Capability Notice. In February 2025 Apple responded not by complying but by pulling Advanced Data Protection from the UK, so that British users lost the option to turn on the strongest iCloud encryption Apple offers. Apple then filed a challenge at the Investigatory Powers Tribunal. We covered that opening chapter in The UK Secretly Ordered Apple to Break iCloud Encryption and, earlier, in Apple vs UK: The Fight Over Your Encrypted Data. This piece is the update: the order was dropped, a new one took its place, and the legal fight moved into open court.

The secret order reaches open court

The most important development is procedural, and it cuts toward transparency. The Investigatory Powers Tribunal is hearing Apple's challenge alongside a separate complaint brought by Privacy International, Liberty, and two individuals, who are challenging the lawfulness, necessity, and secrecy of the Technical Capability Notice regime itself. [3][5]

The government asked the tribunal to keep the entire matter secret. The tribunal rejected that bid, ruling that the case could not be heard entirely behind closed doors. [4] It directed the government and Apple to agree a set of "assumed facts" so that as much of the argument as possible can happen in open session. A seven-day hearing was scheduled for early 2026. As of mid-2026, no final ruling has been announced. WhatsApp asked to intervene and was refused. [3][6]

Privacy International has argued that the government's posture is itself the problem: "The UK Government's insistence on maintaining its 'neither confirm nor deny' position on the widely-discussed order is unsupportable." [3] That secrecy is not incidental. Under the Investigatory Powers Act, simply revealing that an order exists can be a criminal offence, which is how a demand that affects millions of people can be litigated without the public being told what, exactly, is being demanded.

Why a British order is everyone's problem

It is tempting to read the October order as a de-escalation: the UK gave up the global demand and kept only a domestic one. That reading misunderstands how encryption works. End-to-end encryption is a single mathematical property of the system, not a per-country setting. A capability built to let the UK government read "British residents'" encrypted backups is a capability that exists in the product. Once it exists, it can be used against other users, demanded by other governments, or discovered and exploited by attackers. A weakening applied to one jurisdiction weakens the encryption that protects users in Berlin, Sao Paulo, Toronto, and Sydney.

The pattern is not unique to Britain. Australia passed a comparable assistance-and-access law in 2018, the EU has spent years debating "chat control" client-side scanning mandates, and several other governments have floated mandatory-decryption proposals. The UK case matters because it is the furthest along, the most secret, and the one a major US company chose to fight rather than quietly satisfy.

What you can do

Keep Advanced Data Protection on. If you are outside the UK, ADP is still available. Turning it on is what makes your iCloud backups end-to-end encrypted rather than readable by Apple.
Harden your Apple ID. Use a strong device passcode and a hardware security key for two-factor authentication. The encryption only helps if the account around it is hard to take over.
Follow the tribunal. The Investigatory Powers Tribunal case is the rare chance to see this regime argued in open court. Its ruling could set limits on how secretly future orders can be issued.
Back the legal challengers. Privacy International and Liberty are carrying the public-interest side of this case. Their filings are where the strongest arguments against secret backdoor orders are being made.

Sources

  1. Computer Weekly: "US says UK has agreed to drop encryption back door demands against Apple" (August 2025, citing the Financial Times; Gabbard and Vance)
  2. Cloudwards: "UK Government Orders Apple to Create a Backdoor, Again" (October 15, 2025, reporting the Financial Times account of a new British-residents-only order)
  3. Privacy International: "Our case against UK Government's secret surveillance orders to be heard in 2026"
  4. Law Gazette: "Tribunal rejects government bid to keep data privacy row with Apple secret"
  5. Liberty: "UK Government's secret Apple data access order challenged by Liberty and Privacy International"
  6. Investigatory Powers Tribunal: Apple Inc v Secretary of State for the Home Department

Background on the original 2025 order: Joseph Menn, Washington Post (February 7, 2025); Dominic Preston, The Verge (February 7 and 21, 2025); Charles Hymas and James Titcomb, The Daily Telegraph (February 7, 2025).

Published: June 13, 2026