Apple Wanted to Scan Your Photos. Everyone Said No. Then What?

In August 2021, Apple — the company that had built its brand on privacy, the one whose ads promised that what happens on your iPhone stays on your iPhone — announced it would start scanning photos on your device before they were uploaded to iCloud. The outcry was immediate and enormous. Privacy researchers, academics, and ordinary users all said the same thing: no. Within weeks, Apple delayed the plan, and then quietly shelved it.

Most people exhaled and moved on. They should not have. Because the question was never whether Apple would scan your photos. The question was whether Apple could.

That distinction — between intent and capability — is the whole story. And it has not gone away.

The Company You Trusted Most

Apple was the last company anyone expected this from. That was precisely the point. If the most privacy-conscious company in consumer technology could announce, with a straight face, that it would scan the photos on your phone, then the premise most of us live by — that some companies simply would not do that — was never a premise at all. It was a hope.

The plan, as publicly described, was aimed at a serious and legitimate problem. This essay takes no position on that problem, and it does not need to. The argument here is structural, not moral: once a scanning mechanism lives on your device, the device's owner does not control what it scans next. The company does. The matching database, the threshold for a match, the list of things worth flagging — all of it is defined unilaterally, and all of it can change. A capability built for one purpose can be pointed at another purpose with a software update and a press release.

Promises are not architecture. A promise says: we will not. Architecture says: we cannot. The first depends on who is in charge this quarter and what the political weather is. The second depends on physics.

"Understanding" Your Photos Is Seeing Them

There is a second, quieter version of the same problem, and it runs every day without any announcement at all. Your cloud photo library sorts your pictures by face, by place, by event. It knows who your children are, where you were last summer, which gatherings matter to you. That is not an accident of the product. That is the product. A cloud album's business model is understanding your photos, and understanding requires access.

So when people say, "I trust my cloud provider not to look," they are usually saying something narrower and less comforting: "I trust my cloud provider not to look at the things I would mind, in a way I would notice, for a reason I would object to." That is a long chain of trust, and every link in it is held by someone else. The 2021 episode showed how quickly one link can move. A company can wake up one morning, decide that scanning is now a good idea, and announce it as a feature.

This is not a criticism of any one company. Any company large enough to run a cloud service faces the same pressures: regulators, governments, public opinion, lawsuits, advertisers. The pressures change. The capability does not. Capability, once installed, waits patiently for a reason.

Capability, Not Intent

Here is the cold version of the argument, the way a systems engineer would put it: judge a system by what it can do, not by what its current operators say it will do. Operators change. Policies change. Ownership changes. A company can be acquired, a government can pass a law, a court can issue an order. None of those events requires your consent, and none of them announces itself in advance.

Seneca wrote that we suffer more in imagination than in reality — but he also understood that the wise person arranges their life so that they do not have to depend on other people's continued good intentions. Privacy works the same way. The safest arrangement is not one where everyone promises to behave. It is one where behaving badly is not physically possible.

That is why the 2021 story matters more now than it did then. Not because Apple went ahead — it did not — but because it showed us, in public, that the capability was ready, the reasoning was prepared, and the only thing standing between your photo library and a scan was a round of public backlash. Backlash is not a security model. Backlash is a mood, and moods change.

What Cannot Be Scanned

So what do you do with the things that must never be seen by anyone — not a company, not a government, not a future owner of a platform, not an employee having a bad day? You stop asking the question "will they look?" and you remove the possibility of looking altogether.

The things that matter most should not live on a device that phones home, or in a cloud account that can be searched, or on a service whose terms can be rewritten. They should live on a medium that is not connected to anything — a drive that sits on a shelf, sealed, numbered, and checked by two people together, with a photograph taken as a record. Nobody can scan a drive that is not plugged in. Nobody can remotely search a shelf. That is not a promise. That is a fact about the physical world, and physical facts do not change when a company's policy does.

This is not a rejection of technology. Your phone and your cloud album are fine for the ordinary business of life — the pictures you share, the memories you show friends. But for the things that must never be seen by anyone, the standard is different. The standard is: no one can look, because no one is in a position to look. Not "they promised not to." Not "they probably won't." Cannot.

There is an old idea, from Epicurus, that peace of mind comes not from controlling what others do but from removing yourself from dependence on them. You do not need Apple's intentions to stay good forever. You do not need any platform's policy to stay unchanged. You need a place where the question of intent never arises, because the capability does not exist there.

The Check That Changes Nothing

People sometimes ask: but if you hand something to professionals to keep, are you not just moving the trust problem? The answer is in the process. A proper custody process is designed so that trust is not required at any single point. The item is numbered. It is sealed. Two people verify it together, so no one person ever handles it alone. Twice a year, the seal and the appearance are checked visually and photographed — with zero contact, the item itself untouched. Anything beyond that — any closer inspection — happens only if you have given written permission in advance. The people keeping it do not need to be able to read what is inside, and the process is built so that they never do.

That is the difference between handing your life to a platform and entrusting it to a process. A platform asks you to believe its intentions. A process shows you its structure, and the structure is the same no matter who is on duty.

Apple's 2021 announcement was a gift, in a strange way. It showed the world, clearly and in public, that the question is capability, not intent. The people who paid attention did not just change their cloud settings. They changed their standard: from "who promises not to look?" to "where is looking physically impossible?" That is the only standard that survives a change of management, a change of law, and a change of mood.

Your most private things deserve that standard. Not a promise. A shelf, a seal, a number, and two people who check it together — and nothing that can ever scan it from the other side of the world.