Terms Unconditional

Email Providers · Email Provider · Structural / no discrete incident

Apple iCloud Mail

Headline

Apple's structural position is worth recording accurately rather than flattering: iCloud Mail is encrypted in transit and at rest, but Apple holds the keys, which is a materially weaker guarantee than the end-to-end…

Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.

Apple's structural position is worth recording accurately rather than flattering: iCloud Mail is encrypted in transit and at rest, but Apple holds the keys, which is a materially weaker guarantee than the end-to-end model Proton and Tuta use. That means Apple can produce message contents in response to a valid legal order in a way Proton cannot. Apple also does not monetise mail content for advertising, which genuinely distinguishes it from Yahoo, AOL and the free webmail tier generally. Both things are true at once, and the consumer takeaway is that 'Apple is the private one' is correct against ad-funded providers and incorrect against end-to-end ones.

  • SeveritySeverity 2 of 5, not independently verified. Apple's structural position is worth recording accurately rather than flattering: iCloud Mail is encrypted in transit and at rest, but Apple holds the keys, which is a materially weaker guarantee than the end-to-end…
  • Evidence tierUnassigned
  • Claims confirmedNo sourced claims yet
  • Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Last verified 96 days agoverified 96 days ago0180 days
Freshness. Last verified 96 days ago (2026-08-04); stale after 180 days.

Terms

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected.

Data sharing

STRUCTURAL DIFFERENCE FROM PRIVACY-FOCUSED PROVIDERS: Apple encrypts iCloud Mail IN TRANSIT between devices, but Apple itself HOLDS THE DECRYPTION KEYS and is therefore technically able to access message content (Apple has reportedly scanned iCloud Mail for child-safety purposes; not verified this pass) — unlike ProtonMail/Tuta, which use client-side (zero-knowledge) encryption Apple cannot access even if legally compelled. This matters legally: iCloud Mail falls under US privacy law plus federal surveillance authority including FISA orders and the CLOUD Act, which specifically allows US agencies to compel data from global subsidiaries of American companies REGARDLESS of where the physical servers are located or which country's privacy law would otherwise apply — a structural legal-access point that does not exist for Switzerland-based providers like ProtonMail.

Fees and billing

Not itemized this pass.

Contacts

Privacy contact. Not recorded.

Legal notice. PUBLIC COMPANY (AAPL). Service route: c/o General Counsel / Corporate Secretary, Cupertino, California — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.

Mailing address. Not recorded.

No published channel
Paper trail: none. No published channel.

Evidence

No claims have been itemized for this row yet.

No sources are on file for this row yet.

Source vault

Link status: Candidate - not yet fetched

DocumentLast fetchPDF
Privacy policy
apple.com/legal/privacy/
Not fetched yetNO (HTML only)
Terms of service
apple.com/legal/internet-services/icloud/
Not fetched yetNO (HTML only)
Website
apple.com
Not fetched yet—
Primary source
No URL recorded
Verification: Unverified - heuristic first draft
Not fetched yet—

Enforcement

No enforcement actions are linked to this row.

State statute

Headquarters on file: California. Provisions of CCPA/CPRA on file:

ProvisionTypeSource
Right to Deletion
Cal. Civ. Code § 1798.105
hardsource
Right to Correction
Cal. Civ. Code § 1798.106
hardsource
Right to Know / Access
Cal. Civ. Code § 1798.110
hardsource
Right to Limit Use of Sensitive Personal Information
Cal. Civ. Code § 1798.121; Cal. Code Regs. tit. 11, § 7027
hardsource
Right to Data Portability
Cal. Civ. Code § 1798.130(a)(3)(B)(iii)
hardsource
Privacy Policy / Privacy Notice Requirements
Cal. Civ. Code § 1798.130(a)(5); Cal. Code Regs. tit. 11, § 7011
hardsource
Sensitive Personal Information — Categories
Cal. Civ. Code § 1798.140(ae)
hardsource
Service Provider and Contractor Contract Requirements
Cal. Civ. Code § 1798.140(ag); Cal. Code Regs. tit. 11, § 7051
hardsource
Applicability Threshold (2025 CPI-Adjusted)
Cal. Civ. Code § 1798.140(d)
thresholdsource
Privacy Risk Assessment — Mandatory for High-Risk Processing (Eff. Jan. 1, 2026)
Cal. Civ. Code § 1798.185(a)(15); Cal. Code Regs. tit. 11, §§ 7150-7157
hardsource
Right to Opt Out of Sale or Sharing
Cal. Civ. Code §§ 1798.120, 1798.135
hardsource
Sale vs. Sharing Distinction
Cal. Civ. Code §§ 1798.140(ad), 1798.140(ah)
hardsource
Enforcement — CPPA and AG; Civil Penalties (2025 CPI-Adjusted)
Cal. Civ. Code §§ 1798.155, 1798.199.90; Cal. Bus. & Prof. Code § 17206
hardsource
Notice at Collection
Cal. Code Regs. tit. 11, § 7012
hardsource
Cybersecurity Audit — Annual Independent Audit Requirement (Eff. Jan. 1, 2026)
Cal. Code Regs. tit. 11, §§ 7120-7124
hardsource
Automated Decision-Making Technology (ADMT) — Notice, Opt-Out, and Access Rights
Cal. Code Regs. tit. 11, §§ 7200-7222; Cal. Civ. Code § 1798.185(a)(16)
hardsource