Email Providers · Email Provider · Structural / no discrete incident
Apple iCloud Mail
Headline
Apple's structural position is worth recording accurately rather than flattering: iCloud Mail is encrypted in transit and at rest, but Apple holds the keys, which is a materially weaker guarantee than the end-to-end…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Apple's structural position is worth recording accurately rather than flattering: iCloud Mail is encrypted in transit and at rest, but Apple holds the keys, which is a materially weaker guarantee than the end-to-end model Proton and Tuta use. That means Apple can produce message contents in response to a valid legal order in a way Proton cannot. Apple also does not monetise mail content for advertising, which genuinely distinguishes it from Yahoo, AOL and the free webmail tier generally. Both things are true at once, and the consumer takeaway is that 'Apple is the private one' is correct against ad-funded providers and incorrect against end-to-end ones.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
STRUCTURAL DIFFERENCE FROM PRIVACY-FOCUSED PROVIDERS: Apple encrypts iCloud Mail IN TRANSIT between devices, but Apple itself HOLDS THE DECRYPTION KEYS and is therefore technically able to access message content (Apple has reportedly scanned iCloud Mail for child-safety purposes; not verified this pass) — unlike ProtonMail/Tuta, which use client-side (zero-knowledge) encryption Apple cannot access even if legally compelled. This matters legally: iCloud Mail falls under US privacy law plus federal surveillance authority including FISA orders and the CLOUD Act, which specifically allows US agencies to compel data from global subsidiaries of American companies REGARDLESS of where the physical servers are located or which country's privacy law would otherwise apply — a structural legal-access point that does not exist for Switzerland-based providers like ProtonMail.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (AAPL). Service route: c/o General Counsel / Corporate Secretary, Cupertino, California — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy apple.com/legal/privacy/ | Not fetched yet | NO (HTML only) |
| Terms of service apple.com/legal/internet-services/icloud/ | Not fetched yet | NO (HTML only) |
| Website apple.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: California. Provisions of CCPA/CPRA on file:
| Provision | Type | Source |
|---|---|---|
| Right to Deletion Cal. Civ. Code § 1798.105 | hard | source |
| Right to Correction Cal. Civ. Code § 1798.106 | hard | source |
| Right to Know / Access Cal. Civ. Code § 1798.110 | hard | source |
| Right to Limit Use of Sensitive Personal Information Cal. Civ. Code § 1798.121; Cal. Code Regs. tit. 11, § 7027 | hard | source |
| Right to Data Portability Cal. Civ. Code § 1798.130(a)(3)(B)(iii) | hard | source |
| Privacy Policy / Privacy Notice Requirements Cal. Civ. Code § 1798.130(a)(5); Cal. Code Regs. tit. 11, § 7011 | hard | source |
| Sensitive Personal Information — Categories Cal. Civ. Code § 1798.140(ae) | hard | source |
| Service Provider and Contractor Contract Requirements Cal. Civ. Code § 1798.140(ag); Cal. Code Regs. tit. 11, § 7051 | hard | source |
| Applicability Threshold (2025 CPI-Adjusted) Cal. Civ. Code § 1798.140(d) | threshold | source |
| Privacy Risk Assessment — Mandatory for High-Risk Processing (Eff. Jan. 1, 2026) Cal. Civ. Code § 1798.185(a)(15); Cal. Code Regs. tit. 11, §§ 7150-7157 | hard | source |
| Right to Opt Out of Sale or Sharing Cal. Civ. Code §§ 1798.120, 1798.135 | hard | source |
| Sale vs. Sharing Distinction Cal. Civ. Code §§ 1798.140(ad), 1798.140(ah) | hard | source |
| Enforcement — CPPA and AG; Civil Penalties (2025 CPI-Adjusted) Cal. Civ. Code §§ 1798.155, 1798.199.90; Cal. Bus. & Prof. Code § 17206 | hard | source |
| Notice at Collection Cal. Code Regs. tit. 11, § 7012 | hard | source |
| Cybersecurity Audit — Annual Independent Audit Requirement (Eff. Jan. 1, 2026) Cal. Code Regs. tit. 11, §§ 7120-7124 | hard | source |
| Automated Decision-Making Technology (ADMT) — Notice, Opt-Out, and Access Rights Cal. Code Regs. tit. 11, §§ 7200-7222; Cal. Civ. Code § 1798.185(a)(16) | hard | source |