Does Apple Scan Your Photos? A Calm, Accurate Answer

Three different things get merged into this question. Your iPhone does analyse photos on-device, which never leaves the phone. The CSAM scanning plan was abandoned in 2022 and never shipped. Enhanced Visual Search does contact Apple, but is built so Apple can’t see your photos or what’s in them.

The short answer

If you’re asking whether someone at Apple can look through your camera roll, no. If you’re asking whether your phone examines your photos, yes, constantly, and almost entirely on the device in your hand.

The confusion is understandable, because three unrelated systems get discussed as though they’re one. Separating them makes the whole topic manageable, and the honest conclusion is mostly reassuring rather than alarming, with one design decision worth knowing about.

Worth saying plainly: this is an area where a lot of coverage is written to worry people. The facts don’t especially support that, and pretending otherwise would make everything else we write less trustworthy.

What your iPhone does on-device

Open Photos and search for “dog” and you’ll get dogs. Open the People album and your friends are grouped by face. None of that is magic and none of it requires a server.

iOS runs machine-learning analysis across your library locally, identifying objects, scenes, text and faces, and building the index that powers search, People and Pets, and Memories. It generally runs when the phone is locked and charging, which is why a newly restored library takes a night to become searchable.

This processing is genuinely local. The results live on your device, the analysis happens on your device, and the photos themselves aren’t transmitted for it. It’s also the part people find most surprising, because the results feel like something a cloud service would produce.

Two side effects are worth knowing. Because the index is built per device, a new phone starts from scratch and spends its first nights rebuilding what the old one already knew, which is the usual explanation for search suddenly being useless after an upgrade. And because the analysis produces a browsable index with names attached to faces, it quietly makes your library easier for anyone holding your phone to navigate. That’s not a privacy failure on Apple’s part, but it is worth remembering: the same feature that finds your dog in three seconds finds a specific person just as fast.

The CSAM plan that never shipped

In August 2021 Apple announced a system to detect known child sexual abuse material in images being uploaded to iCloud Photos, using on-device matching against a database of known hashes.

The reaction from security researchers and privacy organisations was severe, largely on the grounds that a scanning mechanism on a personal device could later be repurposed under legal pressure. Apple delayed the feature, and in December 2022 formally abandoned it, saying it would focus on other child-safety approaches instead.

It never ran on user devices. This matters because a substantial number of people still believe their iPhone is checking their photos against a government database, and that belief shapes how they read every other Apple photo feature. It isn’t happening.

Enhanced Visual Search: the one that does contact Apple

This is the feature worth understanding properly, because it’s the only one in this article that leaves your device at all.

Enhanced Visual Search arrived with iOS 18 and macOS Sequoia. It lets you search your library for landmarks — a cathedral, a bridge, a mountain, even when the photo carries no GPS or EXIF location. To do that, your phone has to compare something in your photo against a global index of landmarks that’s far too large to store locally.

The way it works is deliberately convoluted, and the convolution is the privacy protection. Your device identifies a region of the photo that might contain a landmark, computes a mathematical representation of that region rather than sending the image, and queries Apple’s index using homomorphic encryption, which allows a server to compute on data it cannot read. The request is passed through a relay that strips your IP address, so Apple can’t tie it to you.

Homomorphic encryption is worth a plain-English detour, because it’s doing the load-bearing work and most people have never met the idea. Normally a server has to decrypt data before it can compute on it, which means the server sees the data. Homomorphic encryption lets the server do arithmetic on the encrypted values directly and hand back an encrypted answer that only your device can open. Imagine posting a locked box, having a stranger sort its contents without ever opening it, and getting the box back still locked. It sounds impossible, it’s mathematically real, and it’s expensive enough that most companies don’t use it for anything.

Apple’s position is that the feature works without sending your photos or videos to Apple, and without Apple learning what’s in them. Reading the technical description, that’s a reasonable claim, and the design goes considerably further than most companies would bother with.

Why people objected anyway

If the cryptography is sound, why was there a fuss in late 2024 and early 2025? Two reasons, and both are legitimate even though neither means your photos were exposed.

The first is consent. The feature arrived switched on, without a prompt, in a software update. Developers and privacy writers pointed out that a feature causing the Photos app to contact a server should be something you opt into, not something you discover afterwards. That’s an argument about defaults, not about encryption, and it’s a fair one.

The second is trust architecture. When a feature is protected by mathematics you can verify, you don’t need to trust the company. When it’s protected by a description of what the company does with the data, you do. Homomorphic encryption is the good kind, but users are being asked to trust that the implementation matches the description, and the only reason anyone knew to check was a developer reading release notes.

Neither objection is that Apple is spying on you. Both are that a photo app quietly gained a network dependency, and you should be able to decide about that. That’s a reasonable place to land.

What talks to a server and what doesn’t

Feature	Where it runs	Leaves your device?	Can you switch it off?
Face, object and scene recognition	On device	No	Not directly
Memories and suggestions	On device	No	Partly, via settings
CSAM detection	Never shipped	Not applicable	Not applicable
Enhanced Visual Search	On device plus Apple index	A private, encrypted query	Yes
Visual Look Up	On device plus lookup service	A query for identification	Yes
iCloud Photos sync	Apple servers	Yes, the photos themselves	Yes

The last row is the one that matters most to most people, and it gets the least attention. Enhanced Visual Search sends an encrypted mathematical fingerprint. iCloud Photos sends the actual photographs. If you’re worried about copies of your images existing on someone else’s computers, that’s the row to think about, and turning on Advanced Data Protection is the meaningful action, which we cover in iCloud Advanced Data Protection.

If you want the minimal setup

None of these steps are urgent. They’re for people who prefer their photo app to stay offline.

1. Turn off Enhanced Visual Search. Settings, then Apps, then Photos, then switch off Enhanced Visual Search. You lose landmark search and nothing else.
2. Turn on Advanced Data Protection if you use iCloud Photos, so your library is end-to-end encrypted rather than merely encrypted in a way Apple holds a key to.
3. Audit which apps have photo access. Third-party apps are a far larger exposure than any Apple feature, and most people have granted full-library access to things that needed one photo. We go through this in which apps can access your photos.
4. Strip location before sharing. Apple’s features aren’t reading your GPS coordinates, but every recipient of a photo you send can.

Notice the ordering. The Apple feature everyone argued about is first only because it’s the one you asked about. Points two and three protect considerably more.

What none of this addresses

Here’s the part that gets lost in arguments about server queries: the most likely person to see your private photos isn’t Apple, and isn’t an attacker. It’s someone holding your unlocked phone.

Every feature above concerns what leaves your device. None of them changes what’s visible to a person scrolling your camera roll, whether that’s a friend you handed the phone to, a partner who knows your passcode, or a repair technician. On-device analysis doesn’t expose your photos to anyone. It also doesn’t protect them from anyone.

That’s a different problem with a different solution, and it’s the one worth acting on if private photos are your actual concern.

Where Arca fits

Arca addresses that second problem. Photos you move into it are encrypted individually with AES-256-GCM, and the key is derived from your PIN using Argon2id, a deliberately slow key-derivation function that makes guessing that PIN expensive rather than instant. Everything stays in the app’s own container on your device, with no server and no account, so there’s no cloud copy, nothing to breach remotely, and nothing to hand over. For situations where you might be pressured to unlock, there’s a decoy vault. The full model is on our security page.

The honest limits, as always: a vault protects the photos you actually move into it, not the ones still in your camera roll. It protects them at rest, not while the vault is open in front of someone. And because Arca keeps nothing on a server, it can’t recover your photos if you forget your PIN, so keep your own backup of anything irreplaceable.

Apple isn’t looking at your photos. That was never the real risk to them.

Get Arca on the App Store to keep your private photos encrypted with AES-256-GCM on your device, with no server in the loop.