![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/07\/when-you-should-retire-your-old-apple-ipad-unsafe-to-use-beard-cane-glasses-600x300-1.jpg\")
<\/p>\n<\/p>\n
When Apple stops issuing security updates for older iPads, they become unsafe to use. But exactly how long can you safely keep using an old iPad?<\/em><\/p>\n Although many people upgrade their iPhones every year or two, they tend to hold onto iPads much longer. This makes sense: most people don\u2019t carry an iPad around with them all the time, and it doesn\u2019t get the same wear and tear that an iPhone does.<\/p>\n You might not be aware that there\u2019s a real danger in using an iPad for too long. If a device can no longer run the latest version of Apple\u2019s iPadOS operating system, it will miss out on a lot of critical security updates. Vulnerabilities that remain unpatched can put you at risk.<\/p>\n In this article, we\u2019ll explain why using an old iPad can be dangerous, and which iPad models are safe to buy in 2024. (See also our articles about when old iPhones become unsafe to use<\/a> and when old Macs become unsafe to use<\/a>.)<\/p>\n Apple regularly issues security updates for all its platforms, and some of these updates patch \u201czero-day vulnerabilities,\u201d which are serious vulnerabilities that are being actively exploited in the wild. This means that they are not mere proof-of-concept vulnerabilities; any device that doesn\u2019t get updated is at risk of becoming compromised (hacked) by threat actors. Most users don\u2019t think much about this, but there is a real danger of not getting security updates for your iPad.<\/p>\n The most serious of these are what are called \u201czero-click\u201d vulnerabilities. This type of vulnerability exploits weaknesses in the operating system to compromise devices\u2014without the user doing anything at all. You don\u2019t have to get tricked into launching an app or tapping on a link to a website. Many of these exploits take advantage of vulnerabilities that occur when, for example, a preview of a webpage or photo is displayed in the Messages or Mail apps.<\/p>\n Zero-click exploits can even infect your device when it\u2019s completely locked, when push notifications display on your Lock Screen. It is well known that the NSO Group\u2019s Pegasus spyware has used zero-click exploits in its arsenal of attacks, which have targeted the devices of politicians, journalists, and activists. Most of these attacks attempt to compromise devices belonging to specific people in order to gain intelligence. (See our story archives about Pegasus<\/a> and zero-click exploits<\/a>.)<\/p>\n Most users don\u2019t need to worry about Pegasus or similar nation-state spyware, per se. However, eventually, the details about the vulnerabilities used by Pegasus and other spyware will come to light. (Notably, Apple gives some details about most of the vulnerabilities it patches. Moreover, savvy experts are able to reverse-engineer Apple\u2019s patches to see exactly how a vulnerability was fixed\u2014and how to exploit it on unpatched devices.) In other words, today\u2019s nation-state attacker\u2019s vulnerability could become part of tomorrow\u2019s everyday cybercriminal\u2019s arsenal<\/strong>. And at that point, if your Apple devices are not up-to-date, then you are at risk from more widespread attacks.<\/p>\n Some vulnerabilities that Apple patches in its security updates involve WebKit, the rendering engine used by the Safari Web browser. In fact, as of December 2024, all third-party browsers on iOS and iPadOS use WebKit; Apple\u2019s App Store policies prohibit browsers like Firefox and Chrome from using their own engines. (In the EU, developers now have the option to distribute non-WebKit versions of their browsers through third-party app marketplaces, but not via Apple’s official App Store.)<\/p>\n Not having a fully up-to-date iPadOS version means that your iPad could be compromised by simply browsing a hacked or malicious site, or even when you view a malicious email with embedded rich Web content.<\/p>\n Apple regularly issues security updates for the current operating systems of all its devices. They occasionally issue security updates for the previous versions of their operating systems, but it\u2019s important to be aware that updates for older Apple OS versions don\u2019t patch all vulnerabilities<\/a>. (In certain cases, some vulnerabilities patched in today\u2019s operating system might not have existed in last year\u2019s operating system, but perhaps more often than not, Apple simply chooses not to back-port a patch.)<\/p>\n Continuing to use the previous operating system version with any Apple device can be risky. Running an Apple device on an operating system older than the previous one is even more dangerous, because Apple has, in many cases, almost completely (or completely) stopped issuing updates.<\/p>\n Unfortunately, Apple doesn\u2019t make this transparent to users. If you\u2019re still using an iPad (5th generation) today, for example, your device cannot run iPadOS 18, but you may still get occasional, partial security updates pushed to your device for iPadOS 16. Unless you read The Mac Security Blog, you\u2019re probably unaware that iPadOS 16 isn\u2019t fully patched<\/strong>, which means it\u2019s much less safe to use than iPadOS 17. As just one recent example, iPadOS 17.4 addressed 39 vulnerabilities that have CVE numbers assigned<\/a>, while the corresponding iPadOS 16 update only patched 19 CVEs\u2014about half as many.<\/p>\n Put more bluntly, Apple gives a false sense of security by providing an incomplete set of patches to the \u201ccurrent minus one\u201d OS<\/strong>, leaving users vulnerable but thinking they\u2019re protected. The same is not just true for iPadOS 17, but also for iOS 17 and macOS Sonoma. Based on Apple\u2019s history over the past several years, we have every reason to expect that the same will be true for the latest Apple operating systems, iOS 18, iPadOS 18, and macOS Sequoia; the \u201cone version old\u201d previous operating systems might still get patches, but will be significantly less safe to use, and significantly more vulnerable to exploitation.<\/p>\n Many people assume that an iPad, if it hasn\u2019t been damaged, should last for four to five years, if not longer. Recent data shows that 40% of people have iPads that are more than three years old<\/a>, and this suggests that many iPads are probably used for more than five years. The iPad is the ideal device to hand down to family members or pass on to friends when it\u2019s replaced; trade-in values for old iPads are generally low, and most iPads don\u2019t offer cellular access, and don\u2019t require data contracts. An old iPad is a handy device to use on Wi-Fi for casual web browsing, email, and simple games.<\/p>\n In order to get the maximum value out of an iPad purchase, it makes the most sense to buy new models when they are first released, or shortly after that time. This will help ensure that you get as many years as possible out of your purchase (as we will continue to explore further in this article). The main thing to know is that when you buy a brand-new model, you can rest assured that it will get the maximum number of years of major new iOS releases\u2014and that means the maximum number of years of security updates, too.<\/p>\n In late 2023, Apple filed a regulatory document in the UK<\/a> stating that they would provide updates for a minimum of five years from the date of first sale. This means that an iPad first sold in September 2023 would be guaranteed to get security updates until at least September 2028. In June 2024, Apple announced the release of iPadOS 18 and stated that devices as old as the iPad Air (3rd generation) and the iPad (7th generation) would be able to run the new operating system. These devices were released in 2019, so that means that they will effectively have at least six years of updates, until the release of iPadOS 19\u2014which they may or may not be able to run. So, in practice, Apple is offering more than five years of updates from the initial date of sale.<\/p>\n The above chart can seem confusing because of Apple\u2019s naming convention for the iPad. Unlike with the iPhone, whose name increments each year, it can be difficult to remember which iPad you have; you can find its name in Settings > General > About. It looks like, going forward, iPad names will contain the processor (M2, M4), which could help make this clearer in the future.<\/p>\n According to Apple\u2019s own statistics<\/a> (as seen in the chart below), as of June 2024, 17% of all iPads were still running iPadOS 16, which means their operating system was nearly a year out of date. (Apple hasn’t yet published updated statistics showing iPadOS 18 data.)<\/p>\n And worse yet, an additional 15% of all iPads were running a version of iPadOS older than iPadOS 16; meaning their operating system was more than three years old<\/em><\/strong>. Many of these may be devices older than those able to run iPadOS 16, but some may also be devices whose owners have simply not upgraded, for a variety of reasons.<\/p>\n In total, 32%\u2014nearly one-third<\/em>\u2014of all iPads were running an outdated operating system, and susceptible to being exploited with known vulnerabilities.<\/strong><\/p>\n And if we just focus on iPad models introduced in the past four years (all of which are iPadOS 17 compatible) 15% of them were still running iPadOS 16, and an additional 8% were running something older than that. On the surface, that means that nearly 1 in 4 recent<\/strong><\/em> iPads are running an old, outdated, and insecure operating system.<\/p>\n Interestingly, these numbers\u2014even the percentage of recent devices running the current operating system\u2014are different for the iPhone. For some reason, people are less likely to update their iPads than their iPhones, which makes iPads, in general, less secure than iPhones, and could make them a better target for hackers and cyber-criminals. (See our related article: When does an old iPhone become unsafe to use?<\/a>)<\/p>\n If we were able to dig deeper into which specific versions of iPadOS users were running, we would likely see that even amongst iPadOS 17 users, relatively few are installing every iPadOS update quickly and staying fully patched at any given time.<\/p>\n If you\u2019re thinking about buying an old iPad model, or a refurbished unit, beware that its safe lifespan is limited. The same is true if you hand an iPad down to a family member; it\u2019s important to ensure that the model in question will still get major iPadOS updates for as long as it is used.<\/p>\n Unlike with the iPhone, where Apple always sells one or two older model iPhones, still new in box, alongside the latest model, the company only sells current model iPads. However, some of the current models may have been around for a long time. As of December 2024, Apple is selling the base model iPad (10th generation), which was released in October 2022. Apple\u2019s five-year commitment to issuing updates is based on when a device was first sold, not<\/em><\/strong> the date you buy it; this means Apple only guarantees that the current iPad (10th generation) will get updates through October 2027<\/strong>. After that date, there is no guarantee, and you could buy an iPad now that will stop getting updates in just over two years, making it insecure.<\/p>\n What about refurbished iPads?<\/strong><\/p>\n Apple also sells some refurbished iPads<\/a>. As of today, the oldest iPad that is currently listed on Apple\u2019s website is the iPad Air (4th Generation), in both the U.S. and UK stores. This model can run iOS 18, but it\u2019s entirely possible that come iOS 19 in fall 2025, Apple may no longer support it. Released in October 2020, Apple\u2019s five-year guarantee runs out in October 2025. In theory, this means that you could potentially buy an iPad Air (4th Generation) directly from Apple that may only be safe to use for between one and two years before it no longer receives security updates.<\/p>\n This is not as bad as Apple selling the Apple Watch Series 3 new after it had stopped getting security updates<\/a><\/em>; it was unconscionable to sell a device that had already been cut off. Apple even continued to sell the Apple Watch Series 3 refurbished<\/em> for eight months after its final security update.<\/p>\n You can buy used, refurbished, or even (ahem) \u201cnew\u201d older iPad models from many sources; Amazon sells them, eBay sellers always have plenty of stock, and mobile carriers\u2019 stores may sell them as well. If you look on eBay, you\u2019ll find plenty of refurbished iPad Air 2 models, selling at very low prices, but this device can only run up to iPadOS 15, which gets no updates. The same is true for the iPad (5th generation), which only supports iPadOS 16, and is not likely to get any updates starting in the fall of 2024 when iPadOS 18 is released. Early iPad Pro models are at risk: the 9.7\u201c versions won\u2019t run iPadOS 17, and the 10.5\u201d model is dropped from support by iPadOS 18.<\/p>\n You may think you\u2019re getting a good deal by buying an old iPad at a super discount, but doing so may put you at risk. It may either have already been cut off from the latest major iPadOS version, or it may soon lose that benefit a few months from now, or in a little over a year; that means you could be cut off from some important security updates.<\/p>\n Unlike with the iPhone, most people don\u2019t upgrade their iPads often. Buying an older model to save money can certainly be tempting, but it\u2019s important to be aware that if you buy one that is more than a couple of years old, it may end up becoming unsafe before you know it. Even if you buy it from Apple.<\/p>\n So when is the best time to buy? If you want to get the maximum lifespan out of your iPad purchase, buy it when the model is brand new. Unlike the iPhone, which is on an annual upgrade cycle in the fall each year, iPad upgrades are more sporadic. For example, in May 2024, Apple upgraded the iPad Air and iPad Pro<\/a>. The previous upgrades to these devices were in March 2020 (iPad Air) and October 2022 (iPad Pro). Over time, most iPad models see upgrades between around 18 and 24 months, with one exception being the iPad mini, which, updated in October 2024, gets refreshed every three years or so.<\/p>\n For more or choosing an iPad, see our article: Which iPad Is Best for You in 2024?<\/a><\/p>\nThe risk of not getting security updates: zero-day and zero-click exploits<\/h3>\n
Zero-click vulnerabilities<\/strong><\/h4>\n
WebKit vulnerabilities affect all iPadOS browsers<\/strong><\/h4>\n
Apple\u2019s patching policy provides a false sense of security<\/strong><\/h4>\n
When should you upgrade your iPad?<\/h3>\n
Which devices can run the latest version of iPadOS?<\/h3>\n
![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/06\/ipad-compatibility-chart.png\")
<\/p>\n![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/06\/ipad-adoption-1.png\")
<\/p>\nThink twice before buying an old model, no matter how good a \u201cdeal\u201d it may seem<\/h3>\n
Should you buy a used, refurbished, or \u201cnew in box\u201d older model of iPad, from a third party?<\/h3>\n
Key takeaways<\/h3>\n