With the arrival of iOS 26.5 , Apple has finally taken the step that had been on the table for years: RCS messages between iPhones and Android phones are now protected with end-to-end encryption. This means that the content of conversations between the two systems no longer travels virtually unencrypted over the carrier's network and is protected against unauthorized access.
The feature not only represents a technical change, but also corrects a long-standing privacy gap in mobile messaging. Until now, messaging from an iPhone to an Android using the Messages app was far less secure than chatting on iMessage, WhatsApp, or Signal. With iOS 26.5, these "green bubble" conversations finally catch up in terms of content protection, albeit with some important nuances.
How RCS encryption works between iPhone and Android in iOS 26.5
End-to-end encryption for RCS in iOS 26.5 relies on the Messaging Layer Security (MLS) protocol , incorporated into the RCS Universal Profile 3.0 standard published by the GSMA in 2025. It is the same cryptographic scheme that Google has been using to encrypt RCS chats between Android devices, but now it is extended interoperably across platforms.
From the user's perspective, the system is designed to work almost automatically. On compatible iPhones, encryption is enabled by default and requires no key configuration or complex settings. However, you can check at any time by going to Settings → Messages → RCS Messaging, where you'll find the "End-to-End Encryption (Beta)" switch.
When a conversation between an iPhone and an Android device meets all the technical requirements, the Messages app displays the label “Text Message · RCS” accompanied by a padlock icon at the top of the message thread . This symbol indicates that the chat is protected with end-to-end encryption (E2EE). Similarly, Google Messages also displays a padlock icon in text bubbles to indicate that encryption is active.
At a technical level, messages are encrypted directly on the sender's device and only decrypted on the recipient's phone. Intermediate servers—whether from Apple, Google, or the carrier— cannot read the content , even though they manage the transmission. The difference compared to unencrypted RCS is clear: previously, part of the transmission route could be in plain text; now, without the private keys stored on the devices, what circulates is an incomprehensible stream of data.
However, this protection applies exclusively to the combination of Messages on iOS and Google Messages on Android . If one of the parties uses a different SMS/RCS app, the conversation can still function as RCS, but without end-to-end encryption, and the padlock icon will not appear.
Requirements: What you need for RCS encryption to work
For RCS end-to-end encryption between iPhone and Android to truly work, three basic conditions must be met simultaneously. If any of these fail, the conversation will remain in unencrypted RCS or even revert to standard SMS.
- iPhone with iOS 26.5 or laterIt is essential to install the new system version. The update can be downloaded from Settings → General → Software Update.
- Android with the latest version of Google MessagesThe other person's mobile phone must use the official Google app for RCS and have the client updated.
- Operators compatible with RCS Universal Profile 3.0: both the iPhone user's network and the Android user's network must have adopted the version of the standard that includes MLS encryption.
If all three pieces fit together, the system automatically activates encryption, and the user only needs to look for the padlock icon that appears in the chat interface . Apple itself notes that the feature is still marked as "beta," so the rollout will be gradual, and it may take some time for it to reach all lines, even within the same country.
When the conditions are not met—for example, because one of the carriers does not yet support the new profile or because the Android device does not use Google Messages—messages may still be sent as unencrypted RCS or as traditional SMS/MMS. In these cases, there will be no lock icon , and the conversation will not have the same level of protection.
For those who prefer to review or disable the feature, Apple includes an explicit control in the RCS Messaging menu: encryption can be manually turned off, although by default it is always kept on to maximize real-world adoption, without forcing the average user to make technical decisions.
What changes compared to previous RCS and iMessage messages
The adoption of RCS on iPhone isn't new: it arrived with iOS 18 in 2024. Since then, conversations with Android have already supported high-quality photos and videos, read receipts, typing indicators, and improved groups. However, that first phase launched without end-to-end encryption , leaving content more vulnerable during transmission.
With iOS 26.5, the situation changes dramatically for these "green bubbles." Cross-platform RCS messages no longer resemble souped-up SMS messages and are now protected against network taps and opportunistic access. For many users, this brings the native mobile experience closer to what they already know from WhatsApp, Signal , or iMessage chats.
Even so, Apple continues to emphasize that iMessage remains the most complete and secure option within the Apple ecosystem. The company's own messaging service has featured end-to-end encryption since its launch, is carrier-independent, and offers additional privacy and control features, especially for conversations exclusively between Apple devices.
The major innovation in iOS 26.5, therefore, is not replacing iMessage, but rather strengthening everything that happens when an Android device joins the conversation. Until now, this cross-platform switch resulted in a loss of cryptographic security; with the new encrypted RCS, this vulnerability is largely closed , without the user having to switch apps or convince their contacts to install additional services.
It's important to clarify that, although the content is encrypted, the communication metadata doesn't disappear . Information such as who is talking to whom, at what time, or from which number remains available to carriers and, to varying degrees, to Apple and Google. In this respect, tools specifically designed for maximum privacy, such as Signal, remain more stringent.
The role of operators and the situation in Spain and Europe
One of the most sensitive aspects of this new feature is its reliance on mobile carrier infrastructure . Apple makes it clear in its documentation that RCS encryption is only available "with compatible carriers" and that its rollout will expand over time. Therefore, simply updating your iPhone or Android device is not enough.
In the United States and Canada, a first wave of telephone companies already supports the new profile, including major players like AT&T, T-Mobile, Verizon, and Bell. In Europe, and in Spain in particular, the situation is more uneven: each operator has its own timeline for adopting RCS Universal Profile 3.0 with MLS , and so far, not all have provided specific dates.
In Spain, the main mobile operators—such as Telefónica (Movistar and O2), Orange, Vodafone, Yoigo, MásMóvil, and Pepephone—already offer various RCS capabilities, but compatibility with the latest profile isn't always enabled on all lines or in all regions. Until this infrastructure is fully updated, many conversations will continue to be unlocked despite using iOS 26.5.
Added to this is the European Union's regulatory context. Regulations such as the GDPR and the European Digital Framework have been pushing for more widespread use of encryption for years, while also demanding transparency in data management. The model that Apple and Google have implemented with encrypted RCS fits with this approach: the message content is protected, but a level of traceability is maintained in the metadata, allowing operators to comply with their legal obligations.
For users in Spain or any other European country, the practical result is that the security of an RCS conversation will depend both on the software they carry and on how quickly their mobile operator adopts the new standard . It is expected that updated official lists will be published in the coming months, clarifying which companies already support E2EE encryption and under what conditions.
From betas to launch: a phased rollout
The road to this release hasn't been overnight. Apple began testing encrypted RCS messaging in the iOS 26.4 betas , but removed the feature before the update was released to the general public. The feature subsequently reappeared in the early iOS 26.5 betas and has been refined through several test builds.
In the iOS 26.5 release candidate changelog, the company explicitly mentions the presence of "end-to-end encrypted RCS messaging (beta) in Messages ," reiterating that its availability depends on carriers and that it will be activated gradually in both new conversations and existing chats.
This phased approach allows Apple and carriers to react if any implementation flaws are detected. The "beta" label is not merely decorative: in the realm of security, any technical vulnerability can have serious consequences, so the company prefers to maintain room to adjust parameters or, in the worst-case scenario, temporarily disable the service in certain regions.
In parallel, Google has also been updating its Messages app to ensure that MLS-based encryption works seamlessly when the other party is an iPhone running iOS 26.5. The coordination between the two companies is one of the most striking aspects of this move, which is presented as a joint industry effort rather than a platform war.
All of this leads to a rollout that, according to Apple, will take place over the next few months. Not all lines will see the lock icon on the same day as the update, but they should gradually adopt the new model as carriers update their systems and the feature is no longer considered strictly experimental.
What does this mean for the daily lives of users in Spain and Europe?
In practice, many users in Spain have relied primarily on WhatsApp, Telegram, or Signal for more sensitive conversations for years. However, the native Messages app remains the gateway for a multitude of everyday interactions, especially with contacts who aren't particularly tech-savvy or who prefer not to depend on too many apps.
With the new RCS encryption, any household or workplace where iPhones and Androids coexist will notice a quiet but significant change: text chats between the two are no longer the weak link . Anyone sending an address, a personal photo, or sensitive data to an Android phone from their iPhone now has an extra layer of protection without changing their habits or installing anything.
This leap will be particularly noticeable for those who still frequently use unencrypted SMS or RCS—for example, older people or users who simply stick with the phone's default settings. Starting with iOS 26.5, under the right conditions, a traditional text message to an Android device will have the same level of security as the most popular messaging apps.
From a privacy perspective, the change significantly reduces the exposure of sensitive information to network interceptions, opportunistic attacks, or failures in the infrastructure of operators and providers. Although metadata will still exist, the message content will be much better protected from external view, which is especially relevant in an environment where more and more personal data is being shared through digital channels.
For those requiring an even higher level of security—such as journalists, activists, or professionals handling highly sensitive information—it will still make sense to rely on services like Signal , designed from the ground up to minimize metadata footprints and offer advanced controls over message lifecycles. The new encrypted RCS is not intended to replace these solutions, but rather to strengthen the basic messaging layer integrated into the operating system itself.
Overall, iOS 26.5 marks a turning point in how iPhones and Android devices communicate: cross-platform conversations no longer travel almost unprotected and now rely on an open encryption standard that keeps content secure end-to-end, provided each user's network is up to the task. The path forward will now depend on the pace of carriers in Spain, Europe, and the rest of the world, but the technical framework is ready so that "green bubbles" are no longer synonymous with reduced privacy.