Direct answer: Apple's three strongest privacy layers do three different jobs. Lockdown Mode is an extreme, opt-in shield against highly sophisticated, personally targeted spyware; Advanced Data Protection adds end-to-end encryption to most of your iCloud data so only your trusted devices can unlock it; and the everyday app-privacy controls in Settings > Privacy & Security decide what each app may access or track. Most people need the third layer, many will benefit from the second, and only a very small group needs the first — but knowing which is which stops you from either leaving your data exposed or switching on a mode that breaks features you rely on.
Three layers, three different threats
It helps to think of Apple privacy as layers, not as one switch. App-privacy controls guard against ordinary data collection: an app reading your location in the background, asking to follow you across other companies' apps and websites, or keeping a permission you granted once and forgot. Advanced Data Protection guards your cloud copy: backups, photos, notes and drive files stored on Apple's servers. Lockdown Mode guards the device itself against an attacker who is willing to spend serious resources on one specific person — the kind of mercenary spyware Apple describes in its support documentation.
None of these layers replaces the basics. Keep your software updated, use a strong device passcode, turn on two-factor authentication for your Apple Account, and be careful with links and attachments from strangers. The features below build on that foundation; they do not substitute for it.
1. Lockdown Mode: extreme protection for a very few people
Apple calls Lockdown Mode an "optional, extreme protection" designed for "the very few individuals who, because of who they are or what they do, might be personally targeted by some of the most sophisticated digital threats." That wording matters. Apple is not describing everyday malware or phishing. It is describing highly targeted mercenary spyware — tools built to break into one person's phone, often without that person tapping anything.
Lockdown Mode is available on iOS 16 or later, iPadOS 16 or later, watchOS 10 or later, and macOS Ventura or later, with additional protections from iOS 17, iPadOS 17, watchOS 10 and macOS Sonoma onward. Apple advises updating your devices to the latest software before turning it on, so you get the complete set of protections.
What Lockdown Mode changes
When it is on, your device deliberately works differently, because Lockdown Mode shrinks the "attack surface" — the set of features an attacker can exploit. According to Apple Support, the changes include:
- Messages: most attachment types are blocked, other than certain images, video and audio. Links and link previews are unavailable.
- Web browsing: certain complex web technologies are blocked, so some websites may load more slowly or not work correctly.
- FaceTime: incoming calls are blocked unless you have called that person or contact within the past 30 days. SharePlay and Live Photos are unavailable.
- Device connections: to connect an iPhone or iPad to an accessory or another computer, the device needs to be unlocked. On a Mac laptop with Apple silicon, the Mac needs to be unlocked and you need to give explicit approval.
- Wireless connectivity: your device will not automatically join non-secure Wi-Fi networks, and 2G and 3G cellular support is turned off for iPhone and iPad.
- Profiles and management: configuration profiles cannot be installed, and the device cannot be enrolled in Mobile Device Management or device supervision while Lockdown Mode is on.
- Sharing: shared albums are removed from Photos, new shared album invitations are blocked, and location information is stripped from shared photos.
Phone calls and plain text messages still work, and emergency features such as SOS emergency calls are not affected. Incoming calls will not ring on a paired Apple Watch, however.
Who needs it — and who does not
Apple's own framing points to journalists, activists, government officials, executives and others whose work could make them a personal target. Independent coverage of the feature consistently reaches the same conclusion: for most people, there is no need to use Lockdown Mode, because the standard protections on a fully updated Apple device already cover everyday threats. Switching it on "just in case" is a real trade-off, not a free upgrade — attachments, web features, calls from new contacts and some Apple services will behave differently, and that friction is the point of the mode.
There is also an important honest limit: Lockdown Mode is designed against highly sophisticated, targeted spyware, not against everyday phishing, scams or common malware. It will not stop you from handing your password to a fake login page, and it will not make a weak passcode strong. If you have received a threat notification from Apple, or you have concrete reason to believe you are being targeted, that is the moment to consider it seriously — and to seek expert advice alongside it, not instead of it.
How to turn Lockdown Mode on
- On iPhone or iPad, open Settings > Privacy & Security, scroll down and tap Lockdown Mode, then tap Turn On Lockdown Mode and confirm. The device restarts.
- On Mac, open System Settings > Privacy & Security, scroll down to Lockdown Mode and turn it on, confirming with your password.
- Turn it on separately for each device. One exception: turning it on for your iPhone automatically turns it on for your paired Apple Watch.
You can soften the edges without switching the whole mode off: once Lockdown Mode is on, you can exclude a trusted website, app or contact from some restrictions. Apple warns that excluding anything reduces the protection and increases risk, so do it only for something you genuinely trust and genuinely need.
2. Advanced Data Protection: end-to-end encryption for most of iCloud
Advanced Data Protection for iCloud is, in Apple's words, an optional setting that offers Apple's "highest level of cloud data security." With it on, the majority of your iCloud data — including iCloud Backup, Photos, Notes and more — is protected using end-to-end encryption. That means only your trusted devices can decrypt it. Apple does not hold the keys, so Apple cannot read that data either.
That distinction is the whole point. Under standard iCloud data protection, your data is still encrypted, but Apple holds keys that let it recover your data if you lose access — which also means a breach of Apple's systems or a legal demand could, in principle, reach it. Advanced Data Protection removes Apple from that equation for the categories it covers. The trade-off is symmetrical: if you lose access to your account and have no recovery method set up, Apple cannot help you recover your end-to-end encrypted data.
What it covers — and what it does not
Apple's support page lists iCloud Backup, Photos and Notes among the categories protected, and its security documentation extends end-to-end encryption to further categories such as iCloud Drive, Reminders, Safari bookmarks and Voice Memos. Three important exceptions remain, because they must interoperate with global systems: iCloud Mail, Contacts and Calendar are not end-to-end encrypted even with Advanced Data Protection on. Sharing has limits too — iWork collaboration, the Shared Albums feature in Photos, and sharing content with "anyone with the link" do not support Advanced Data Protection, so that shared content is not end-to-end encrypted even when the setting is enabled.
Advanced Data Protection is designed to maintain end-to-end encryption for shared content as long as all participants have it enabled, including iCloud Shared Photo Library, iCloud Drive shared folders and shared Notes. If you share sensitive material with someone who has not turned it on, do not assume it carries the same protection.
Before you turn it on
Apple requires you to set up at least one alternative recovery method first — a recovery contact or a recovery key — precisely because it will no longer be able to recover the data for you. A recovery key is a 28-character code you store offline, somewhere safe; a recovery contact is a trusted person with an Apple device who can help you regain access. Pick the method you will actually be able to use in a stressful moment, and store the key somewhere other than the phone it protects.
You also need an Apple Account with two-factor authentication, and updated software on all devices signed in to that account — iPhone with iOS 16.2 or later is Apple's stated floor, with the latest software recommended. Managed Apple Accounts and child accounts are not eligible. Note also that availability varies by country or region: Apple says it can no longer offer Advanced Data Protection to new users in the United Kingdom, so if you have not already turned it on there, the option will not be available to you. The reliable check is your own Settings screen.
How to turn Advanced Data Protection on
- Update the iPhone, iPad or Mac you are using to the latest software.
- On iPhone or iPad, open Settings, tap your name, tap iCloud, scroll down and tap Advanced Data Protection, then tap Turn on Advanced Data Protection.
- On Mac, open System Settings, click your name, click iCloud, then Advanced Data Protection and Turn On.
- Follow the onscreen instructions to review your recovery methods and enable it. Turning it on from one device enables it for your entire account and all compatible devices.
You can turn it off at any time; your device will then securely upload the required encryption keys to Apple servers and your account returns to standard data protection.
3. App-privacy controls: the layer everyone should use
If Lockdown Mode is the panic room and Advanced Data Protection is the vault, app-privacy controls are the front door locks — and they are the layer most people neglect. Every app permission you grant is a standing decision, not a one-time event. An app you installed two years ago may still hold location, contacts, photo or microphone access you no longer intend to give it.
Review permissions by data type
On iPhone or iPad, go to Settings > Privacy & Security and review the list of data types — Calendars, Contacts, Photos, Reminders, Location Services, Camera, Microphone and more. Tap a data type to see which apps have access, then grant or remove permission app by app. An app does not appear on a list until it has asked for permission, so a short list is not necessarily a problem — it may simply mean few apps have asked.
Location deserves its own pass. For most apps, "While Using the App" is enough; "Always" should be reserved for apps that genuinely need background location, such as a navigation or family-safety app you trust. Photos deserves one too: "Selected Photos" lets you hand over only the pictures an app needs, instead of your whole library.
Stop cross-app tracking
App Tracking Transparency, introduced in iOS 14.5, requires apps to ask permission before tracking your activity across other companies' apps and websites, mainly for advertising. If you answer "Ask App Not to Track," the app cannot access your device's advertising identifier. To stop the prompts entirely, go to Settings > Privacy & Security > Tracking and turn off Allow Apps to Request to Track. With that switch off, every app that asks is treated as if you said no.
Be honest about what this does and does not do. It blocks cross-app tracking for advertising; it does not block first-party data collection. An app can still use information you actively give it — your name, email or location entered inside the app — and it can still show you ads, just less personalised ones. Tracking controls are about profiling, not about making ads disappear.
Turn on App Privacy Report and actually read it
App Privacy Report, found at Settings > Privacy & Security > App Privacy Report, is Apple's built-in log of what your apps do with their permissions. Once turned on, it shows how often each app accessed privacy-sensitive data or device sensors — location, camera, microphone, contacts, photos — in the past 7 days, plus the network domains apps contacted. The report data is encrypted and stored only on your device.
Two quirks matter. First, the report only starts gathering information after you turn it on, so it may take a while for details to appear; give it a week of normal use before judging anything. Second, it does not block apps automatically — it gives you the information to act. If an app checks your location dozens of times a day without a clear reason, go back to its permission and limit it, or remove it entirely. Turning the report off at any time also clears its data from your device.
A sensible monthly routine: open App Privacy Report, look for background access you cannot explain, revoke anything you do not recognise, and check Tracking to confirm no app you meant to block has been allowed back in. Ten minutes a month beats a one-time permissions purge you never repeat.
Which combination is right for you?
| Feature | What it protects | Who should use it | Main trade-off |
|---|---|---|---|
| App-privacy controls (permissions, Tracking, App Privacy Report) | Your data on the device, against app collection and cross-app tracking | Everyone with an iPhone, iPad or Mac | Occasional re-prompting; some features need a permission re-granted |
| Advanced Data Protection | Most iCloud data, with end-to-end encryption Apple cannot unlock | Anyone who stores sensitive photos, notes, backups or files in iCloud | Apple cannot recover your data if you lose access; set up recovery first |
| Lockdown Mode | The device itself, against highly sophisticated targeted spyware | People at elevated personal risk: journalists, activists, officials, executives handling sensitive work | Attachments, web features, calls from new contacts and some services are restricted |
For most readers, the right order is: permissions audit first, tracking off second, App Privacy Report on third, Advanced Data Protection fourth (after setting up recovery), and Lockdown Mode only if your risk profile genuinely calls for it. That order gives you the biggest privacy gain for the least disruption, and it leaves the extreme tool for the extreme case it was built for.
What none of these features protect you from
Honest limits matter more than marketing. None of these three layers stops phishing — a convincing fake login page will still capture a password you type into it. None of them protects data you voluntarily post publicly, send to a stranger, or hand to an app under its own privacy policy. Lockdown Mode does not make a weak passcode strong. Advanced Data Protection does not encrypt iCloud Mail, Contacts or Calendar, and it does not cover content shared through "anyone with the link." App Tracking Transparency does not stop first-party collection inside an app you use. Treat these features as strong locks on specific doors, not as a guarantee that every door is locked.
If you need help hardening an Apple device for sensitive work, or setting up Advanced Data Protection with a recovery plan you can actually rely on, Asad Webs can walk through it with you — the goal is a setup you understand, not a list of switches you enabled once and forgot.
Frequently Asked Questions
Should everyone turn on Lockdown Mode?
No. Apple designed Lockdown Mode for the very few individuals who might be personally targeted by highly sophisticated threats, such as mercenary spyware. For most people it adds friction — blocked attachments, restricted web features, blocked calls from new contacts — without a matching benefit, because standard protections on a fully updated device already cover everyday threats.
Does Advanced Data Protection encrypt everything in iCloud?
No. It end-to-end encrypts the majority of iCloud data, including iCloud Backup, Photos and Notes, but iCloud Mail, Contacts and Calendar are not end-to-end encrypted even with it on, because they must work with global email, contacts and calendar systems. Some sharing methods, including iWork collaboration, Shared Albums and "anyone with the link" sharing, are also not covered.
What happens if I lose access with Advanced Data Protection on?
Apple cannot help you recover your end-to-end encrypted data, because it does not hold the keys. That is why Apple requires a recovery contact or a 28-character recovery key to be set up before you enable it. Store the key offline, somewhere other than the device it protects.
Does turning off tracking stop ads?
No. App Tracking Transparency stops apps from tracking your activity across other companies' apps and websites for advertising, and blocks access to your advertising identifier. You will still see ads; they will simply be less personalised. Apps can also still use data you actively provide inside the app.
How is App Privacy Report different from the permission settings?
Permission settings decide what an app may access. App Privacy Report shows what apps actually did with that access over the past 7 days — how often they used your location, camera, microphone or other sensitive data, and which network domains they contacted. The report itself does not block anything; you act on what it reveals.
Do I need to enable Lockdown Mode on every device?
Yes, with one exception. Lockdown Mode must be turned on separately for your iPhone, iPad and Mac, but turning it on for your iPhone automatically turns it on for your paired Apple Watch. Apple recommends updating all devices to the latest software first, for the complete set of protections.
Be the first to share a useful question or thought.