Encryption Laws Secria

Encryption lawsUnited Kingdom

The Investigatory Powers Act and technical capability notices

Section 253 of the UK's Investigatory Powers Act 2016 lets the Home Secretary require a provider to keep the ability to remove encryption it applies. Apple's dispute over iCloud encryption turns on this power.1, 2

Checked 28 October 2026 against the sources. This page describes the law. It is not legal advice.

What a technical capability notice is

A notice from the Secretary of State to a postal or telecommunications operator, requiring it to be able to help with warrants and other authorisations under the Act.1

What it can requireObligations set out in regulations, which may include "the removal by a relevant operator of electronic protection applied by or on behalf of that operator to any communications or data". The 2018 Regulations add "where reasonably practicable".1, 3Section 253(5)(c); Technical Capability Regulations 2018, Schedule, paragraph 8.
Who decidesThe Secretary of State must consider the notice necessary and proportionate, and a Judicial Commissioner must approve the decision.1Section 253(1).
What must be weighedThe benefits, the number of users, technical feasibility and cost. For a notice about removing encryption, feasibility and cost "in particular".4Section 255(3) and (4).
ReachA notice "may be given to persons outside the United Kingdom", and may require things to be done outside it.1Section 253(8).
SecrecyThe company and its staff must not disclose that a notice exists, or what it says, without the Secretary of State's permission.4Section 255(8).
How long it lastsTwo years from the day it is given, unless it is varied, renewed or revoked before then.4Section 255(5A) and (5B), in force since 14 October 2024.
ReviewThe company can refer a notice back to the Secretary of State, who must consult the Technical Advisory Board and a Judicial Commissioner. Confirming or varying it needs the Investigatory Powers Commissioner's approval.5Section 257.
 Investigatory Powers Act 2016, as amended, read at legislation.gov.uk on 28 October 2026.

What the 2024 amendments added

The Investigatory Powers (Amendment) Act 2024 made two changes that bear on encryption. Both came into force on 20 June 2025.5, 6

No changes while a notice is under review

Referring a notice back no longer pauses everything. While the review runs, the company "must not make any relevant changes" to the services the notice covers, meaning changes that would have "a negative effect" on its ability to give the assistance a warrant may require.5 This is section 257(3A) and (3B).

Notification notices

New section 258A lets the Secretary of State require an operator to give notice of proposals to make relevant changes, a reasonable time before it makes them. Which changes count is set by regulations, which may define them by their effect on the operator's ability to help with warrants.6 It applies to operators that provide, or have provided, assistance under the Act, and the notice itself must be kept secret.6

The Apple case

Advanced Data Protection is an optional Apple setting that extends end-to-end encryption to more iCloud data. The UK government neither confirms nor denies that any notice was given to Apple.2, 9

  1. The Washington Post reports that the Home Secretary served Apple with a technical capability notice in January. The tribunal's judgment records the report.7
  2. Apple starts removing Advanced Data Protection for customers in the UK, as reported by the BBC.8
  3. The Investigatory Powers Tribunal dismisses the Home Secretary's application to keep the bare details of Apple's case private: "It would have been a truly extraordinary step to conduct a hearing entirely in secret".7
  4. US Director of National Intelligence Tulsi Gabbard says the UK agreed to drop its demand. The Home Office says it "does not comment on operational matters, including confirming or denying the existence of such notices".9
  5. Apple's notice to UK users: the 10 iCloud categories that Advanced Data Protection covers fall back to Standard Data Protection for users who had not turned it on. Apple says it is "hopeful" it can offer the feature in the UK in future.2
  6. Apple files a new complaint about a notice reported to cover UK users' data, according to the Financial Times as reported by CyberInsider.10
  7. Case management hearing at the tribunal, where Privacy International and Liberty, who are separately challenging the notice powers, argued against the government's "neither confirm nor deny" stance, as reported by Lawyer Monthly.11

The 2026 steps come from news reports. The tribunal had not published them when we checked.

Questions people ask

Does the Investigatory Powers Act ban end-to-end encryption?

No. It lets the Secretary of State require a provider to be able to remove encryption the provider applied, subject to approval by a Judicial Commissioner. The 2018 Regulations limit that to where it is "reasonably practicable".1, 3

Can UK users still turn on Advanced Data Protection?

Not new users. Apple's notice says UK users who had not already enabled it no longer have the option, and that it continues to be available everywhere else.2

Can a notice be given to a company outside the UK?

Yes. Section 253(8) says a notice may be given to persons outside the United Kingdom, and section 255(6) sets out how it can be delivered to them.1, 4

Who has received a technical capability notice?

The law forbids recipients from saying, and the government's policy is to neither confirm nor deny individual notices. The tribunal's April 2025 judgment records that policy.4, 7

Sources 11
  1. Investigatory Powers Act 2016, section 253: technical capability notices, legislation.gov.uk, The National Archives. Read 28 October 2026.
  2. Apple can no longer offer Advanced Data Protection in the United Kingdom to new users (published 22 September 2025), Apple Support. Read 28 October 2026.
  3. The Investigatory Powers (Technical Capability) Regulations 2018, SI 2018/353, Schedule, legislation.gov.uk, The National Archives. Read 28 October 2026.
  4. Investigatory Powers Act 2016, section 255: further provision about notices, legislation.gov.uk, The National Archives. Read 28 October 2026.
  5. Investigatory Powers Act 2016, section 257: review of notices by the Secretary of State, legislation.gov.uk, The National Archives. Read 28 October 2026.
  6. Investigatory Powers Act 2016, section 258A: notification of proposed changes, legislation.gov.uk, The National Archives. Read 28 October 2026.
  7. Apple Inc v Secretary of State for the Home Department [2025] UKIPTrib 1, IPT/25/68/CH, 7 April 2025, Investigatory Powers Tribunal. Read 28 October 2026 from the Internet Archive copy of 1 October 2026.
  8. Apple pulls data protection tool after UK government security row, 21 February 2025, BBC News. Read 28 October 2026.
  9. Gabbard says UK scraps demand for Apple to give backdoor access to data, 19 August 2025, Associated Press. Read 28 October 2026.
  10. Apple challenges new UK demand to access encrypted iCloud data, 4 August 2026, CyberInsider, reporting the Financial Times. Read 28 October 2026.
  11. Apple data access secrecy challenged at UK tribunal, 18 September 2026, Lawyer Monthly. Read 28 October 2026.

We read the law itself, and every status has a date. How we check