Is Apple Suing the UK Government? The IPT Fight Over Encryption Secrecy

Is Apple suing the UK government? The short answer

Apple is not suing in the ordinary sense of a damages claim in the High Court. It is using the only route the law allows for this kind of dispute: a claim and complaint to the Investigatory Powers Tribunal (IPT) against the Secretary of State for the Home Department. The first claim, brought in 2025 as Apple Inc v Secretary of State for the Home Department, raised "issues as to the Secretary of State's powers to make Technical Capability Notices under the Investigatory Powers Act 2016", according to the tribunal's public judgment of 7 April 2025. That claim was dismissed in October 2025 after the circumstances changed, and Apple has since filed a new one.

Running alongside Apple's claim is a separate complaint brought by Privacy International, Liberty and two individual claimants, recorded under case number IPT/25/83/CH. It challenges both the lawfulness and the secrecy of the whole regime governing technical capability notices, not only the order reportedly served on Apple.

Three features make the case unusual. First, nobody on the government side will say whether the order exists, even though its existence has been reported worldwide. Second, Apple itself is barred by statute from disclosing the notice, so it cannot explain its own claim in public. Third, the dispute has drawn in the United States government at the highest level. For a company that has fought regulators on several fronts, including its challenge to its gatekeeper status under the EU Digital Markets Act, this is a different kind of fight: one about state access to data, conducted largely in private.

Timeline: from the first report to the September 2026 hearing

The story has unfolded over nineteen months, with most of the facts coming from press reporting, court documents and statements by US officials rather than from the parties themselves. The table below sets out the key steps in order, drawing on the tribunal's April 2025 judgment, Privacy International's case record and contemporaneous reporting.

Date	Event	Source
7 February 2025	The Washington Post reports that the Home Secretary served a technical capability notice on Apple in January requiring a blanket capability to view fully encrypted material	IPT judgment, para 14
21 February 2025	Apple stops new UK users turning on Advanced Data Protection	BBC; Apple
25 February 2025	US Director of National Intelligence Tulsi Gabbard writes to Senator Ron Wyden and Congressman Andy Biggs expressing "grave concern"	IPT judgment, para 16
13 March 2025	Privacy International, Liberty and two individuals file their complaint	IPT judgment, para 33
14 March 2025	Private hearing on the Home Office's bid to keep the case secret	IPT judgment
7 April 2025	Tribunal rejects the bid; bare details of the case may be published	[2025] UKIPTrib 1
23 July 2025	Case management order: hearing on "assumed facts"; WhatsApp refused permission to intervene	Privacy International
19 August 2025	Gabbard says the UK has agreed to drop its demand as it affects Americans	Al Jazeera
October 2025	Financial Times reports a new notice targeting British users; on 6 October the tribunal dismisses Apple's first claim	Computer Weekly; Privacy International
February 2026	Privacy International files an amended complaint	Privacy International
Early August 2026	Reports that Apple has lodged a new claim at the tribunal	MacRumors; Privacy International
17 September 2026	Case management hearing on the "neither confirm nor deny" position	Reuters
December 2026	Substantive hearing of the Privacy International claim currently listed	Privacy International

The dates matter because each stage has narrowed the dispute. What began as a reported global demand became, after US pressure, a demand reported to cover UK users only. What began as a fight over whether the case could be mentioned at all is now a fight over whether the government can keep refusing to acknowledge a notice that everyone is discussing.

What is a technical capability notice under the Investigatory Powers Act 2016?

A technical capability notice is a written order from the Home Secretary requiring a communications provider to build and maintain the ability to help the authorities carry out warrants and authorisations, and it can include an obligation to remove encryption the provider itself has applied. The power sits in section 253 of the Investigatory Powers Act 2016. The Secretary of State may give a notice if she considers it necessary to secure that an operator has the capability to provide assistance, considers the required conduct proportionate, and the decision has been approved by a Judicial Commissioner.

Section 253(5)(c) expressly contemplates "obligations relating to the removal by a relevant operator of electronic protection applied by or on behalf of that operator to any communications or data". The detailed obligations are set out in the Investigatory Powers (Technical Capability) Regulations 2018, which include a duty to maintain the capability to remove such protection "where reasonably practicable".

The safeguards and the reach

The Act builds in several checks. Under section 254, the Judicial Commissioner reviews necessity and proportionality on judicial review principles. Before giving a notice, section 255 requires the Home Secretary to consult the operator and weigh the likely benefits, the number of users affected, technical feasibility and cost, with particular attention to feasibility and cost where encryption removal is involved. A company can also refer the notice back for review under section 257, which brings in the Technical Advisory Board and a Judicial Commissioner.

The reach is wide. Section 253(8) provides that a notice "may be given to persons outside the United Kingdom (and may require things to be done, or not to be done, outside the United Kingdom)". That is why a notice served on a California company could, at least on paper, affect users anywhere in the world, and why the original reported demand alarmed Washington.

The secrecy duty

The feature at the heart of the current hearing is section 255(8): a person given a notice, and anyone employed or engaged for its business, "must not disclose the existence or contents of the notice to any other person without the permission of the Secretary of State". The duty can be enforced by an injunction. So Apple cannot confirm what it has received, and the Home Office will not.

Why Apple withdrew Advanced Data Protection in the UK

Apple withdrew Advanced Data Protection for new UK users because the feature puts the encryption keys for most iCloud data on the user's own devices, so Apple itself cannot read that data, and the reported notice would have required it to keep the ability to do exactly that. From 3pm on 21 February 2025, the BBC reported, any UK user trying to turn the feature on met an error message. Apple said it was "gravely disappointed" and repeated that it had "never built a backdoor or master key to any of our products, and we never will". The Home Office told the BBC it did not comment on operational matters, "including for example confirming or denying the existence of any such notices".

According to Apple's support notice, ten iCloud data categories lose the option of end-to-end encryption in the UK: iCloud Backup, iCloud Drive, Photos, Notes, Reminders, Safari Bookmarks, Siri Shortcuts, Voice Memos, Wallet Passes and Freeform. Those categories fall back to Standard Data Protection, under which Apple holds the keys and can respond to lawful requests. Fifteen other categories, including iCloud Keychain and Health data, remain end-to-end encrypted by default, and iMessage and FaceTime stay end-to-end encrypted globally, including in the UK. Existing UK users of the feature were told they would be given time to disable it themselves, because Apple cannot switch it off for them.

Will the feature come back? Apple has said only that it hopes to offer the highest level of security "in the future in the United Kingdom". For British customers the practical effect is that iCloud backups, which can include copies of messages, are no longer shielded from Apple. Anyone thinking about their rights over the personal data companies hold should also read our guide to the right of access under the GDPR, which works quite differently from state access under surveillance law.

How Apple's first claim ended and why it filed a new one

Apple's first claim ended in October 2025 because the notice it was challenging was, on the reported facts, replaced by a narrower one. In August 2025 Tulsi Gabbard announced that the UK had agreed to drop its mandate for a back door that would have reached Americans' data, a step reported on 19 August 2025 after months of contact between the two governments. Within days, however, a tribunal filing reported by City AM on 29 August 2025 indicated that the demand, as it then stood in the proceedings, still extended to customers outside the UK.

In October 2025 the Financial Times reported that the Home Office had withdrawn the first notice and issued a second one targeting British users. On 6 October the tribunal dismissed Apple's claim "on the basis of a change in circumstances which, the tribunal has decided, means the claim should no longer proceed", Computer Weekly reported. A UCL law lecturer quoted in that report suggested Apple may have concluded it was unlikely to win against an order limited to UK users.

That reading has not held. In early August 2026 MacRumors, citing the Financial Times, reported that Apple had filed a new complaint over the demand for access to UK users' encrypted iCloud backups, and Privacy International says it was informed that Apple had filed a new claim against the UK's powers to issue technical capability notices. Accounts differ on exactly when the second notice was issued and when Apple filed, and because of the secrecy duty neither party has confirmed either date.

The 17 September hearing: neither confirm nor deny on trial

The hearing on 17 September 2026 was a case management hearing, and its central question was whether the government may keep refusing to confirm or deny the notice while the tribunal decides the claims. Neither confirm nor deny, usually shortened to NCND, is a long-standing government policy in national security matters: officials will not say whether a particular warrant, operation or notice exists, so that the pattern of answers cannot itself give information away.

For Privacy International and Liberty, Ben Jaffey KC told the tribunal that the government's position had "become farcical", Reuters reported. "The horse has long bolted," he said, pointing out that US politicians and officials had publicly referred to the original notice and that unnamed UK government sources had confirmed it to the press. Both he and Apple's counsel argued that the NCND policy was an affront to open justice and prevented meaningful public discussion of the issue.

For the government, Neil Sheldon KC argued that the question went beyond the Apple case. Any move away from the policy posed a national security risk, he said, and "would provide material assistance to hostile actors" who could then build up a picture of which operators were subject to notices. That is the real stake for the Home Office: if it must confirm one notice, it may struggle to maintain NCND for others, and silence about some companies could start to look like confirmation.

The tribunal reserved its decision on NCND. According to 9to5Mac's account of the hearing, which drew on the Reuters report, a full hearing on the notice itself is unlikely before 2027.

Open justice and national security: what the tribunal decided in April 2025

The tribunal has already rejected one attempt at total secrecy, and its reasoning frames the current argument. In early 2025 the Home Secretary applied for an order that "the bare details of the case", meaning the fact of the claim, its details and the identities of the parties, should be private. The application was heard in private on 14 March 2025 by Lord Justice Singh, the tribunal's President, and Mr Justice Johnson. Daniel Beard KC appeared for Apple; Sir James Eadie KC and Neil Sheldon KC appeared for the Home Secretary.

The judges went further than the Home Office wanted even before that hearing. When the government asked for the hearing not to be listed publicly at all, the tribunal refused, saying it "would have been a truly extraordinary step to conduct a hearing entirely in secret without any public revelation of the fact that a hearing was taking place". The Home Office relied on a witness statement from the head of its Investigatory Powers Unit about the harm disclosure would cause.

In its public judgment, [2025] UKIPTrib 1, the tribunal accepted that considerable weight must be given to the Secretary of State's assessment of national security risk, but held, for reasons given in a private judgment, that it did "not accept that the revelation of the bare details of the case would be damaging to the public interest or prejudicial to national security". The application was dismissed. The BBC and nine other media organisations, PA Media, Big Brother Watch, Privacy International and Liberty had all made submissions in favour of openness, as had members of the US Congress. For lawyers interested in how courts balance these interests, the judgment is a compact restatement of the constitutional principle of open justice as it applies to a tribunal that often sits in private.

What the April ruling did not do is decide whether the notice itself can be acknowledged. The tribunal was careful to say that neither side had confirmed or denied the media reports and that its judgment should not be read as indicating they were accurate. That is the gap the September hearing is trying to close.

The Privacy International and Liberty challenge

The civil liberties groups' complaint is broader than Apple's because it attacks the notice regime itself. Privacy International describes it as a challenge "to both the lawfulness and the secrecy of the legal regime governing Technical Capability Notices". The individual claimants are Gus Hosein and Ben Wizner, and the claimants are represented by Leigh Day with Ben Jaffey KC and Celia Rooney of Blackstone Chambers, according to Leigh Day's March 2025 announcement.

The grounds, as summarised by Leigh Day, are that the notice breaches privacy rights, that issuing it and hearing the challenge in secret infringes freedom of expression, that it does not meet the requirements of the Regulations, and that encryption functions fall outside the telecommunications services the Act is designed to reach. The claimants seek, among other things, the quashing of the notice.

In July 2025 the tribunal directed the government to agree "assumed facts" with Apple so that as much of both claims as possible could be heard in open, and refused WhatsApp's application to intervene, Privacy International reported. The timetable has since moved on: Privacy International filed an amended complaint in February 2026, and its substantive hearing is currently listed for December 2026. When the case was admitted in April 2025, Liberty's director Akiko Hart said, in a statement, that end-to-end encryption "is an essential security tool that protects our personal data".

How the Investigatory Powers Tribunal works, and what comes after it

The Investigatory Powers Tribunal is a specialist court created by section 65 of the Regulation of Investigatory Powers Act 2000. It is the only appropriate tribunal for Human Rights Act claims against the intelligence services and in respect of certain surveillance conduct, and it determines complaints from people who believe they have been subject to that conduct. Its members include senior judges, and its rules require it to prevent disclosure contrary to national security, which is why much of its work happens in private and why it relies heavily on counsel to the tribunal to test the government's evidence.

Its decisions are not the end of the road. Since the Investigatory Powers Act 2016 inserted section 67A into RIPA, a party can appeal on a point of law to the Court of Appeal in England and Wales or the Court of Session, with permission from the tribunal or the appellate court. Permission requires an important point of principle or practice, or another compelling reason. A ruling on whether the NCND policy can be maintained in the face of worldwide reporting would plausibly meet that test, so an appeal by the losing side is a realistic prospect. Apple is no stranger to appellate litigation in London, having taken its $502m FRAND patent dispute with Optis to the UK Supreme Court.

For businesses that find themselves on the receiving end of state powers, the tribunal route is specialised and procedurally unusual. Advisers with experience of regulatory and public law and contentious proceedings against the state are usually involved from the outset.

The United States dimension

The case became a diplomatic issue because the original reported notice was said to reach Apple users worldwide, including Americans. On 25 February 2025 Tulsi Gabbard wrote to Senator Ron Wyden and Congressman Andy Biggs that a requirement for Apple to create a back door into Americans' encrypted data would be "a clear and egregious violation of Americans' privacy and civil liberties", as recorded in the tribunal's April 2025 judgment. Two days later, in an interview with The Spectator quoted in the same judgment, President Donald Trump said of the UK: "We told them you can't do this."

Senator Wyden and other members of Congress also wrote to the tribunal urging it to hear the case in public, and asked for permission to discuss the alleged notice with Congress, a request the tribunal said was a matter for the Home Secretary rather than for it. By August 2025 the pressure produced the announced climbdown on Americans' data. The episode sits alongside other transatlantic frictions over data and digital regulation, such as the dispute over whether the EU-US Data Privacy Framework remains valid.

The narrowing matters legally as well as politically. A notice confined to UK users removes the most obvious objection from Washington, but it does not answer the civil liberties groups' argument that weakening encryption for any users weakens it for all, nor the open justice point now before the tribunal. US businesses with UK operations will want advisers in the United States and in London to coordinate, because conduct required by a UK notice can collide with US privacy commitments and contractual promises to customers.

The human rights backdrop: Podchasov v Russia

The strongest human rights authority on encryption back doors comes from Strasbourg. In Podchasov v Russia (application no. 33696/19), decided on 13 February 2024, the European Court of Human Rights unanimously found a violation of Article 8 of the European Convention on Human Rights over Russian rules requiring Telegram to hand over decryption information. The court held that a requirement to decrypt end-to-end encrypted communications "cannot be regarded as necessary in a democratic society", noting that weakening encryption could enable routine, general and indiscriminate surveillance and create vulnerabilities criminals could exploit, as summarised by the Council of Europe's IRIS Merlin database.

The UK remains a party to the Convention, and Convention rights are given effect domestically through the Human Rights Act 1998, which is the basis of the tribunal's jurisdiction over rights claims. Podchasov concerned a blanket regime without adequate safeguards, and the government will say the Investigatory Powers Act is different: notices must be necessary and proportionate, approved by a Judicial Commissioner and reviewable. How the tribunal weighs those safeguards against the Strasbourg reasoning is likely to be one of the central legal questions at the substantive hearings.

What the case means for technology companies and in-house counsel

The immediate lesson for in-house counsel is that UK surveillance obligations can arrive as confidential notices that the recipient is legally forbidden to discuss, which complicates board reporting, customer communications and disclosure. Apple's options were to comply, to withdraw a product, or to litigate largely in the dark, and it has done the last two. The UK statute book now contains several overlapping powers, set out below.

Power	Legal basis	What it can require	Key safeguard
Technical capability notice	IPA 2016, s 253	Build and maintain capabilities to assist with warrants, including removing electronic protection the operator applied	Judicial Commissioner approval; review under s 257
National security notice	IPA 2016, s 252	Steps a UK telecommunications operator must take that the Secretary of State considers necessary in the interests of national security	Judicial Commissioner approval
Notification notice	IPA 2016, s 258A (in force 20 June 2025)	Tell the Home Office in advance of proposed relevant changes to services or systems	Necessity and proportionality test; operator consultation; its own secrecy duty
Online safety notice	Online Safety Act 2023, s 121	Use accredited technology to identify and remove child sexual exploitation content, whether communicated publicly or privately	Ofcom process and accreditation

The 2024 amendments deserve attention. Section 258A, inserted by the Investigatory Powers (Amendment) Act 2024 and in force from 20 June 2025, lets the Home Secretary require an operator to notify her of proposed relevant changes, and section 257(3A) now bars a company that has referred a notice for review from making changes that would reduce its capability while the review runs. In practice that can freeze a product roadmap. The separate power in section 121 of the Online Safety Act 2023 reaches private communications for child sexual exploitation content, a policy area where UK police chiefs have also pressed for tighter controls, as in their call for restrictions on under-16s' social media use.

A practical checklist

• Map exposure. Identify which services could make the business a "relevant operator" under the Act, including cloud storage and messaging features offered to UK users.
• Plan for secrecy. Agree in advance who inside the company may know about a notice, since section 255(8) covers employees and contractors, and how the board will be briefed within the permission regime.
• Use the review route. The section 257 reference brings in the Technical Advisory Board and a Judicial Commissioner, and is the main way to contest feasibility and cost before litigation.
• Check customer promises. Public statements that a company "cannot" access data may need to be reconciled with possible legal obligations in different jurisdictions.
• Coordinate across regimes. Obligations under EU rules, from the Digital Services Act that produced AliExpress's €550m fine to the phased duties in the EU AI Act timeline, run alongside UK surveillance duties and can pull in different directions.

Security failures carry their own legal cost, as defence contractors have found in US enforcement such as the LOGZONE cybersecurity False Claims Act settlement. The Apple case shows the opposite pressure: a state asking a company to hold capabilities that security engineers regard as a weakness. Businesses facing either kind of scrutiny often draw on specialists in government investigations as well as technical teams.

When to take specialist advice

A company that receives, or expects to receive, a notice under the Investigatory Powers Act should take advice before it responds, because the consultation stage under section 255(2) and the review route under section 257 are where the terms of a notice can most readily be shaped. The secrecy duty means that advice must be structured carefully, and the company should confirm what the Home Office will permit it to share with its advisers.

Specialist input usually spans three areas: technology, media and telecoms lawyers who understand how the Act applies to particular services, cyber security advisers who can assess feasibility and risk, and public law counsel for any tribunal proceedings. Corporate INTL's directory lists advisers in the United Kingdom across these practice areas.

So, is Apple suing the UK government? It is challenging the Home Secretary in the Investigatory Powers Tribunal, alongside a parallel challenge from Privacy International and Liberty, and the next milestones are the tribunal's ruling on neither confirm nor deny and the December 2026 hearing of the civil liberties groups' claim, with Apple's own full hearing unlikely before 2027. Whatever the outcome, the case will shape how far the UK can compel providers of encrypted services to change their systems, and how much of that pressure can stay hidden from the people it affects.

Frequently asked questions

Is Apple suing the UK government?

Apple has brought a claim against the Home Secretary in the Investigatory Powers Tribunal over a reported technical capability notice requiring access to encrypted iCloud data. Its first claim was dismissed in October 2025 after the notice was reportedly replaced, and reports in August 2026 said it had filed a new one.

What is a technical capability notice?

It is a written order under section 253 of the Investigatory Powers Act 2016 requiring a communications operator to maintain capabilities to assist with warrants and authorisations, which can include removing encryption the operator applied. It must be necessary and proportionate and approved by a Judicial Commissioner, and recipients must not disclose it.

Why can't Apple offer Advanced Data Protection in the UK anymore?

Advanced Data Protection keeps the encryption keys for most iCloud data on users' devices, so Apple cannot read it. After reports of a UK notice requiring access, Apple stopped new UK users enabling the feature on 21 February 2025, saying it would never build a back door or master key.

Is Advanced Data Protection coming back to the UK?

There is no date. Apple has said it hopes to offer the highest level of security in the UK in future. Whether that happens is likely to depend on the outcome of the tribunal proceedings and on whether the reported notice remains in force in its current form.

Does the UK government have access to Apple users' data?

With a lawful warrant, the authorities can seek data Apple can access, which in the UK now includes iCloud backups under Standard Data Protection. Fifteen categories, including iCloud Keychain and Health, remain end-to-end encrypted by default, as do iMessage and FaceTime, so Apple cannot read those.

What does "neither confirm nor deny" mean in this case?

It is the government's long-standing policy of refusing to say whether a particular surveillance measure exists. The Home Office applies it to the reported Apple notice. On 17 September 2026 the claimants argued the policy had become farcical; the government said dropping it would assist hostile actors. The tribunal reserved its ruling.

Who is challenging the notice besides Apple?

Privacy International, Liberty and two individuals, Gus Hosein and Ben Wizner, brought a complaint on 13 March 2025, recorded as IPT/25/83/CH. It challenges the lawfulness and secrecy of the whole technical capability notice regime, and its substantive hearing is listed for December 2026.

When will the Apple case be decided?

The tribunal will rule on the neither confirm nor deny issue at a later date. Reuters reported that a full hearing of the case itself is unlikely until 2027. Either side may seek permission to appeal a tribunal decision on a point of law to the Court of Appeal.

Can a UK notice apply to a company based outside the UK?

Yes. Section 253(8) of the Investigatory Powers Act says a technical capability notice may be given to persons outside the United Kingdom and may require things to be done outside it. Enforcement abroad by injunction is limited to notices relating to certain interception warrants and communications data authorisations.

Sources

1. Reuters (via Euronext): UK silence over demand for Apple data access is farcical, lawyer says (17 September 2026)
2. Privacy International: PI Apple TCN Challenge, IPT/25/83/CH
3. Investigatory Powers Tribunal: Apple Inc v Secretary of State for the Home Department [2025] UKIPTrib 1 (7 April 2025)
4. Investigatory Powers Act 2016, section 253
5. Investigatory Powers Act 2016, section 254
6. Investigatory Powers Act 2016, section 255
7. Investigatory Powers Act 2016, section 257
8. Investigatory Powers Act 2016, section 258A
9. Investigatory Powers (Technical Capability) Regulations 2018, Schedule 1
10. Regulation of Investigatory Powers Act 2000, section 65
11. Regulation of Investigatory Powers Act 2000, section 67A
12. Online Safety Act 2023, section 121
13. Apple Support: Apple can no longer offer Advanced Data Protection in the United Kingdom to new users
14. BBC News: Apple pulls data protection tool after UK government security row (21 February 2025)
15. Computer Weekly: Court dismisses Apple's appeal against Home Office backdoor (13 October 2025)
16. Al Jazeera: UK agrees to drop mandate for Apple back door, US spy chief says (19 August 2025)
17. City AM: Tribunal filing shows UK pushed for wider back-door access to Apple data (29 August 2025)
18. MacRumors: Apple launches new legal challenge against UK backdoor demand (3 August 2026)
19. 9to5Mac: Apple pushes UK court to lift secrecy around encryption backdoor order (17 September 2026)
20. Leigh Day: UK Government's secret Apple data access order challenged by Privacy International and Liberty (13 March 2025)
21. Liberty: Liberty and Privacy International complaint to be heard by Tribunal (7 April 2025)
22. Privacy International: Update, our case against UK Government's secret surveillance orders to be heard in 2026 (24 July 2025)
23. Council of Europe IRIS Merlin: European Court of Human Rights, Podchasov v Russia

About this article

This analysis was researched and written by The Corporate INTL Newsroom, which covers cross-border legal, regulatory and business developments for lawyers, professional advisers and financiers in over 150 jurisdictions. It has been checked against the Investigatory Powers Tribunal's public judgment, the text of the Investigatory Powers Act 2016 and related legislation, the claimants' published case materials and primary reporting. The technical capability notice itself has not been published or officially acknowledged, and references to its content are based on reporting. This article is general information, not legal advice; for advice on a specific matter, consult a qualified adviser. Last reviewed 18 September 2026. For more analysis like this, visit the Corporate INTL newsroom or subscribe to Corporate INTL.