Apple has opened a new front in its long-running confrontation with the British Government, filing a fresh legal complaint at the Investigatory Powers Tribunal over Home Office demands for access to encrypted cloud back-ups belonging to United Kingdom customers. The move deepens a transatlantic dispute over surveillance powers that has drawn in the White House, provoked warnings from civil liberties groups, and raised uncomfortable questions about where the line between national security and personal privacy should sit in a democracy.
The complaint, first reported by the Financial Times, challenges the Home Office's use of a Technical Capability Notice, or TCN, an order issued under the Investigatory Powers Act 2016. The Act, referred to by critics as the "Snooper's Charter", was designed to give law enforcement and intelligence agencies expanded tools to combat serious crime and terrorism. This is understood to be the first publicly known use of a TCN aimed at breaking end-to-end encryption on a major consumer platform.
A Dispute That Reached the White House
The confrontation began early last year when Yvette Cooper, then home secretary, issued demands for access under the 2016 legislation. Ministers initially sought a mechanism that would have covered both British and American Apple users, an approach that triggered a diplomatic row between Westminster and Washington. President Donald Trump publicly compared the British request to surveillance tactics associated with the Chinese state, and under pressure from his administration the Government retreated from the broader demand.
In its place, the Home Office issued a narrower TCN restricted to data belonging to United Kingdom customers. It is that narrower order which Apple is now contesting. Both Apple and the Home Office are legally barred, under provisions of the Investigatory Powers Act, from confirming or denying the existence of any specific TCN, a secrecy regime that has itself become a focus of legal challenges.
Apple's Position and the Withdrawal of a Security Feature
Apple has repeatedly stated that it will not build what it describes as a "back door" into its devices or services, arguing that any deliberate weakness introduced for one Government would be exploitable by others, including hostile states and criminal actors. The company outlines its approach on its privacy policy page, and its position on Government requests is detailed in its published transparency reports.
Rather than comply with the order to weaken its encryption, Apple in early 2025 withdrew its Advanced Data Protection feature from users in the United Kingdom. The feature, introduced globally in December 2022, extends end-to-end encryption to iCloud back-ups, photos, notes, voice memos and message archives. According to Apple's own documentation, Advanced Data Protection secures 14 additional categories of iCloud data, taking the total number of protected categories to 23. British customers can no longer enable that layer of protection, meaning their cloud back-ups remain accessible to Apple, and therefore, in principle, to lawful requests from the authorities.
The Scale of the Question
Apple's global installed base has surpassed 2.2 billion active devices, according to figures reported in its most recent shareholder disclosures. In the United Kingdom alone, iPhone accounts for approximately 52 per cent of the smartphone market, according to data from Statcounter GlobalStats, which means the dispute directly touches the everyday communications of tens of millions of citizens.
End-to-end encryption is not a fringe technology. It underpins WhatsApp, used by an estimated 40 million people in the United Kingdom, Signal, iMessage, and the secure back-up systems on which banks, hospitals and Government departments themselves rely. Cyber security industry body ENISA has consistently classified strong encryption as an essential component of critical national infrastructure. Reported cybercrime losses in the United Kingdom exceeded £1.2 billion in the most recent full year, according to figures published by Action Fraud, a figure that privacy advocates cite when arguing that weakening encryption would cost more than it saves.
Why Is the Home Office Reading Our Phones, and Where Does Privacy Fit?
The Home Office states that Technical Capability Notices are used to assist investigations into terrorism, child sexual exploitation and organised crime, categories where encrypted communications have complicated law enforcement work. Ministers argue that without lawful access to the contents of devices and cloud services, prosecutions can collapse and victims remain unprotected.
Yet the scope of the order raises questions that go well beyond individual cases. A TCN does not target a named suspect. It compels a company to redesign its systems so that data can, in principle, be produced on request. Once such a capability exists, it is available for use against any account the authorities choose, subject to internal authorisation processes that are themselves classified. Critics contend this represents a structural shift from targeted surveillance, historically conducted with a warrant against a specific individual, to a form of general capability that inverts the traditional relationship between the citizen and the state.
The right to privacy is not a matter of preference but a legal entitlement. Article 8 of the European Convention on Human Rights, incorporated into domestic law by the Human Rights Act 1998, guarantees respect for private and family life, home and correspondence. Any interference must be lawful, necessary in a democratic society and proportionate. Whether a blanket capability applied to the cloud back-ups of an entire national customer base can meet the proportionality test is precisely the question the Tribunal will be asked to consider.
The Information Commissioner's Office has previously stated that encryption is a fundamental safeguard for personal data under the UK General Data Protection Regulation, a position that sits uneasily with legal instruments designed to compel its removal. Independent reviewer of terrorism legislation Jonathan Hall KC has also observed that the secrecy provisions attached to TCNs limit meaningful public scrutiny.
Campaigners and the Press
Privacy International and Liberty have filed a separate challenge at the Tribunal, arguing that the use of TCNs against consumer encryption sets a precedent with global consequences. In a statement, Privacy International said, "We call upon legislators in the UK Parliament to challenge the Government's use of Technical Capability Notices and the chilling effect these notices have globally on individuals' privacy and security." Liberty has argued that the powers "were sold to Parliament as tools against terrorism, not as instruments to redesign the global internet".
Media organisations have also pushed back against the secrecy surrounding the case. The Telegraph, alongside the BBC, The Guardian, the Financial Times, The Sun and The Times, last year successfully challenged an application by Ms Cooper for a gagging order that would have prevented even the bare details of the case from being reported. The Tribunal accepted that the principle of open justice required at least some public disclosure.
What Happens Next
The Investigatory Powers Tribunal is expected to hear preliminary arguments in the coming months. Its rulings can be appealed to the Court of Appeal and, ultimately, to the Supreme Court. In parallel, the Home Office is understood to be reviewing whether the current framework requires updating in light of the diplomatic and commercial fallout.
For now, British Apple customers remain in an unusual position. Their most sensitive cloud data is protected by less encryption than that offered to customers in the United States, France or Germany, not because the technology is unavailable, but because their own Government has instructed the company to hold back. Whether that trade-off is judged necessary, proportionate and lawful will be for the Tribunal, and eventually Parliament, to decide.