By default, yes. iCloud uses Standard data protection unless you change it. Your photos are encrypted, but Apple keeps the keys so it can help you recover your data (Apple: iCloud data security overview). If Apple holds the key, Apple can open your files. If you turn on Advanced Data Protection, iCloud Photos becomes end-to-end encrypted and only your devices hold the keys.
Google doesn't describe Google Photos as end-to-end encrypted, and says it may process your photos to run features inside Photos (Google).
With an end-to-end encrypted service such as Ente, only your devices hold the key, so the company can't see your photos at all.
What's the difference between encrypted and end-to-end encrypted?
- Encrypted at rest: Your photos are scrambled on the company's servers, but the company holds the key. This protects you if someone steals a hard drive. It doesn't stop the company from opening your files, or anyone who can make the company open them.
- End-to-end encrypted (E2EE): Your photos are encrypted on your device before upload, and only your devices have the key. The company stores data it can't read.
Are iCloud Photos end-to-end encrypted?
Not by default. Under Standard data protection, Apple encrypts your data in transit and at rest, and keeps the encryption keys in its data centres. Apple end-to-end encrypts 15 categories of data under Standard protection, such as Health data and passwords, but Photos isn't one of them (Apple: iCloud data security overview).
With Advanced Data Protection (ADP) on, Photos, iCloud Backup, Notes and more become end-to-end encrypted. The catch is that if you lose access to your account, Apple can't recover that data for you. You'll need your device passcode, a recovery contact or a recovery key. You turn ADP on in your iCloud settings, and Apple's Advanced Data Protection page lists the steps and requirements.
ADP has some limits (Apple):
- Shared Albums and "anyone with the link" sharing don't support ADP, so they stay under standard protection.
- iCloud Shared Photo Library stays end-to-end encrypted only if everyone in it has ADP on.
- Web access at iCloud.com is switched off unless you approve it.
Can Google see your Google Photos?
Google doesn't describe Google Photos as end-to-end encrypted. It says your Photos data isn't used for ads, and isn't used to train generative AI models outside Google Photos (Google: Gemini features privacy hub).
What's the most secure way to store personal photos?
Look for four things:
- End-to-end encryption on by default, covering metadata such as location and dates as well as the photos themselves.
- Published security details, such as an architecture document or an independent audit.
- A clear recovery plan. With E2EE, if you lose your password and recovery key, nobody can get your data back.
- Two-factor authentication on the account.
Services that end-to-end encrypt photos include iCloud (with Advanced Data Protection on), Proton Drive and Ente. iCloud and Ente are photo apps. Proton Drive is a cloud drive with a photo gallery.
How Ente protects your photos
- Everything is end-to-end encrypted: Photos, videos and all their metadata, including EXIF, location and descriptions (Ente: security and privacy FAQ).
- Audited cryptography: Encryption uses libsodium, an externally audited cryptography library. The full design is in Ente's architecture document.
- Independent audits: Ente has been audited by Cure53 with Symbolic Software (Cure53 report), and again in an audit done for CERN (CERN audit details).
- Open source: Ente's apps and server are open source, so anyone can check how the encryption works (GitHub).
- Recovery: If you lose both your password and your recovery key, Ente support can't recover your account. A legacy contact you set up beforehand may be able to (Ente: security and privacy FAQ).
To try it, get Ente on your phone. The free plan includes 10 GB.
FAQ
Can the police get my photos? A company can only hand over data it can read. With end-to-end encryption, all it has is encrypted data it has no key for.
Are public share links private? On Ente, public links stay end-to-end encrypted, but the key is inside the link, so anyone who has the link can view the photos. For anything sensitive, add a password and an expiry date (Ente).