Your files are safe on these free file-sharing platforms — but is your privacy?

Are you using free versions of Dropbox, Wetransfer, iCloud, or Box? Well, you should be aware that neither of these popular file-sharing platforms detect malicious software such as viruses and ransomware — cyberattacks that lock your files for ransom. Whereas Google Drive and OneDrive protect your files, what about your privacy?

Key insights

• We analyzed six popular file-sharing platforms used by over four billion people. Google Drive, with two billion active users¹, and Microsoft’s OneDrive, with 400 million registered users², are the only platforms that scan for viruses during file uploads or downloads for free users, although Google limits virus scanning to files up to 100 MB³. Meanwhile, platforms such as Box⁴ and WeTransfer⁵, which together have a total of 138 million registered users, do not scan for viruses on free plans but begin scanning files on paid plans. Dropbox, with 700 million registered users⁶, does not offer this feature at all. The lack of virus scanning on free file-sharing platforms increases the risk of users unknowingly downloading or sharing malicious files.
• Apple’s iCloud, which has 900 million active users⁷, does not scan files during upload or download, but instead relies on Apple device security. While this approach works within Apple’s ecosystem, problems may arise when using iCloud cross-platform. For example, when using iCloud on Windows, it is possible to upload malicious files, which could later be downloaded onto another Windows device.
• Although virus scanning adds a valuable layer of security, it raises privacy concerns, as automated scan systems grant companies access to your files. When choosing a file-sharing platform, carefully weigh the trade-off between security and potential privacy risks.
• All of the analyzed file sharing platforms encrypt your data both in transit and at rest, meaning your files remain encrypted both while being transferred and while stored on their servers. While this encryption feature is now standard in the industry, the United Kingdom government recently demanded that Apple grant it backdoor access to user data stored on iCloud⁸. Initially, the UK sought access to all Apple users’ data globally, but has since limited its request to data belonging only to the UK users. To address this, Apple has removed its Advanced Data Protection feature for the UK market rather than creating a backdoor, which means that users in the UK will only have access to standard encryption, which allows Apple to retain the encryption keys and access user data if required, instead of only the users having access to their data.
• In addition to some governments potentially gaining access to your files on these platforms, users should also be aware of the risk of login information being leaked. This can happen through company data breaches or other means, such as phishing campaigns. To address these risks, you can protect your account by enabling two-factor authentication (2FA), which helps prevent unauthorized access even if your password is compromised. All of the analyzed platforms offer this feature for both free and paid users, and additionally most platforms also send notifications about unusual logins, with the exception of WeTransfer.
• In case your files are deleted or lost, five out of six platforms offer a file recovery option for free users, typically covering the last 30 days. WeTransfer, however, only allows file recovery for paid users. While file recovery can help mitigate the effects of ransomware, Google Drive and Microsoft OneDrive provide an additional layer of ransomware protection for free users. In contrast, Dropbox and Box offer this feature only to paid users, and neither WeTransfer nor iCloud offers built-in ransomware protection.
• While all major file sharing platforms offer encryption and two-factor authentication, there are major differences in how they protect users from viruses, ransomware, and data loss. Free users in particular may not have access to essential safeguards, making careful platform selection and additional personal security measures vital.

Methodology and sources

For this study, we selected six file-sharing platforms (Google Drive, Microsoft OneDrive, Dropbox, Box, WeTransfer, and iCloud) based on their frequent mention in leading technology news articles and industry reports. We then evaluated each platform using the following criteria:

• Active/registered users: number of active monthly users or total registered users;
• Virus scanning (upload/download): whether the platform scans files for viruses during upload or download;
• Ransomware protection: the platform’s ability to detect, alert, or recover from ransomware attacks;
• File recovery: options for restoring files after loss, deletion, or security incidents;
• Encryption (in transit/at rest): whether files are encrypted during transfer and while stored on the platform’s servers;
• Two-factor authentication (2FA): whether the platform provides the ability to enable 2FA.

References: