To be clear, ADP default on would mean a massive influx in support requests for people that lose their data because they don't have the recovery key.

Same reason FileVault isn't on by default on macs.

On the one hand: yes. On the other hand, the ADP setting is located in the moral equivalent of the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.’

Apple could do a lot to promote this feature to more advanced users, but they don’t. I don’t believe for a second this decision is unrelated to the government pressure they’ve been receiving from the UK.

It requires two physical security keys. You can promote the hell out of it, but having to buy and set up security keys is going to stop most people.

You don't need security keys to enable ADP. You need to setup a Recovery Contact or create a Recovery Key.

This is not correct.

Is “Settings -> iCloud -> Advanced Data Protection” really the “moral equivalent of the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying Beware of the leopard”? Where else would you put it? I could see an argument for putting it in “Settings -> Privacy and Security -> Advanced Data Protection” but that to me feels like a “six if one, half dozen of the other” change.

You could suggest it during initial setup. You could advertise the feature beyond a weirdly named setting at the scroll-down portion of the iCloud page. You could call it something more descriptive like “end to end encrypted iCloud”, which would distinguish it from other security features. You could periodically ask users to do checkups, and verify that their backup contacts are still active and available — even if they’re not actively using ADP.

The best analogy I can give is the way Apple gradually raised MFA from an optional feature with 1-2% adoption to a recommended feature that had majority adoption (even if it was not required.) They did this by heavily encouraging users to turn the feature on during setup, and then bugging them about it after setup. Apple is capable of encouraging and advertising security features it cares about, even when there’s risk.

I think the requirement of having a recovery contact or key is placing too much burden and complexity on an average user. I think that's why they also keep it off the setup screens not to mention that your personal device ecosystem has to be supported (no legacy device or software). Anyone seeking improved privacy and security will discover ADP and the nuanced setup.

This is a set of engineering problems to be navigated, not really a fundamental challenge. My critique is that Apple isn't navigating those problems. Many of these problems have solutions, some of which don't require a ton of work.

1. Legacy devices are going away naturally. I doubt the number of Apple accounts with legacy (iOS/Mac) devices and routine iCloud usage is anywhere near a majority, and I assume the number drops every year. You can test for this condition whenever a user adds a new device, and encourage adoption for people who don't have this problem.

2. Apple already requires that you have backup phones and emails for MFA. They could easily enforce recovery contacts as a basic requirement for any new iOS device (even if ADP isn't turned on) and measure the stability of those relationships over time, until they're confident that these recovery relationships are viable. This would probably reduce their support costs as well.

3. Apple has a tool called "Safety Check" that's designed to help you secure your device. Last I checked, ADP isn't recommended or even mentioned by the tool as an option. This seems like an obvious place where Apple could boost understanding and knowledge about ADP, but they've chosen not to.

So yes, I do think there's quite a bit more that Apple could do. I think it's unfortunate that people believe that Apple is not currently downplaying this feature globally due to the UK mess, because that is certainly what they are doing.