Apple has launched a new legal challenge against a UK government demand for access to customers’ highly encrypted data, a year after the Home Office agreed to abandon its previous request. The US tech company filed the legal complaint last month at the Investigatory Powers Tribunal (IPT), an independent court that can investigate claims that the UK intelligence services have acted unlawfully.
The UK government had made a second request for Apple to grant it a “back door” to encrypted iCloud data belonging to British users, according to an order issued by the court. Britain backed down on its original demand for access to data from UK and US customers last year, after a heated transatlantic tussle over encryption between London and Washington. UK authorities then issued a new “technical capability notice” (TCN) to Apple that did not apply to American users.
What is Apple challenging?
Apple is seeking to challenge the British government’s powers to issue TCNs under the UK Investigatory Powers Act, according to details of the new legal case first reported by the Financial Times. The legislation compels companies to provide information to law enforcement agencies working on cases including terrorism and child sexual abuse. This can include forcing companies to provide the UK security services with access to customer data, even if such information is protected by secure encryption.
Apple has confirmed it has launched the complaint, although it has not said what it relates to. The BBC reported that the company declined to give details, while the Financial Times said it is another challenge to a Home Office demand for so-called “backdoor” access to highly encrypted Apple user data.
The court sent an order giving notice of the new Apple complaint to the human rights group Privacy International, which, alongside fellow campaigner Liberty, had previously launched a separate complaint against TCNs at the IPT.
What have campaigners asked the tribunal to do?
Campaigners have asked for Apple’s claims to be held in public given the public interest in the matter, and have also raised a complaint “disputing the lawfulness, necessity and secrecy of the purported Apple TCN and the legal regime underpinning TCNs in general”. A case management hearing to discuss how the parallel complaints should be handled had been scheduled for next month, Privacy International said.
Privacy International welcomed the new complaint, saying it was pleased Apple was again challenging the UK’s regime of secret orders. The group said that if the case relates to the previously reported orders aimed at undermining the security of Apple’s iCloud storage, it would be crucial to preserving privacy and security.
“We are happy to learn that Apple is once again challenging the UK’s regime of secret orders,” said Privacy International. “While we don’t know the substance of Apple’s claim, if it relates to the previously reported orders aimed at undermining the security of Apple’s iCloud storage, then Apple’s claim, alongside side ours and Liberty’s, is crucially important to preserving all of our privacy and security.”
Liberty said the case was “hugely important” and could have long-term implications for privacy rights. Its director of external relations, Ruth Ehrlich, said end-to-end encryption was an essential security tool that protects personal data including bank details, health information, private conversations and images.
“Opening a backdoor to all of that information carries a wide range of risks to our personal data. It is critical that the Government listens to the many concerns and commits to protecting our privacy rights,” she said.
How have Apple and the Home Office responded?
Neither Apple nor the Home Office responded to requests for comment. Both are legally restricted from discussing TCNs. The original TCN issued last year asked Apple for the right to see users’ encrypted data protected by its advanced data protection (ADP) programme in the event of a national security risk.
Apple said the removal of the tool – which not even it can access – would make users more vulnerable to data breaches from bad actors and other threats to customer privacy. Creating a “back door” would also mean all data was accessible by Apple, which it could be forced to share with law enforcement possessing a warrant.
As a result, Apple ended UK customers’ access to its ADP programme in January 2025. The company has previously said it was “gravely disappointed” that it could still not offer Advanced Data Protection to new UK users after its decision to withdraw it in February 2025.
“As we have said many times before, we have never built a backdoor or master key to any of our products or services and we never will,” Apple said in a statement last year.
Since last February, UK iPhone users have been met with a notice on the Advanced Data Protection settings page which says the tool cannot be enabled. Advanced Data Protection is an opt-in feature that allows users to turn on a higher level of protection for data stored in iCloud, such as back-ups, Drive storage, photos and voice memos. It is secured using end-to-end encryption, meaning not even Apple would be able to see its contents.
The government had fought unsuccessfully to keep legal challenges to its first notice to Apple secret. Its notice was later withdrawn after angering US politicians, who were concerned it would affect their own citizen’s data. But the government issued a new request in October which did not apply to US users.
The Home Office has maintained that the Investigatory Powers Act, under which such orders are issued, contains robust safeguards and is used only when absolutely necessary. In a statement, it said it would not comment on legal proceedings or what it called “operational matters”. It added: “The UK supports strong encryption and robust privacy protections, but it is also vital that law enforcement can access communications when necessary and proportionate to protect the public from terrorism, serious crime, and child sexual abuse.”
Sir Brian Leveson, the Investigatory Powers Commissioner, who provides independent oversight of the use of surveillance powers, has previously criticised media use of the term “backdoor”. He said notices such as those concerned in this case would only be issued “if the Secretary of State deems it necessary and proportionate, and this decision is independently reviewed and approved by a Judicial Commissioner”. He added requests for data would also require separate authorisation under the IPA and these would be subject to independent oversight.
Key Facts
- Apple filed the legal complaint last month at the Investigatory Powers Tribunal (IPT).
- The UK government issued a new “technical capability notice” (TCN) that did not apply to American users.
- The original TCN last year sought access to data protected by Apple’s advanced data protection (ADP) programme.
- Apple ended UK customers’ access to ADP in January 2025.
- Privacy International said a case management hearing had been scheduled for next month.
