Activation Lock on a Mac: what it is and why a drive wipe won't defeat it#

Activation Lock on a Mac ties the serial number to the previous owner's Apple Account at the firmware and Secure Enclave level. Once it engages, that Apple Account's password is required before anyone can turn off Find My, erase the Mac, or reactivate it after a wipe. A clean macOS reinstall does not bypass it. Erasing the drive is precisely what the lock is built to survive. (Apple Support 102541) For the pre-purchase workflow, Activation Lock and Find My Mac, before paying covers the in-person check buyers can run in five minutes.

The mental model that works for Windows ("wipe the drive and the machine is clean") does not apply here, and that mismatch is the single most expensive misunderstanding in the used-Mac market. It tops the security-and-lock entries in the used-Mac vocabulary for that reason.

Which Macs can be Activation Locked#

Activation Lock exists only on Macs with hardware capable of enforcing it:

• Apple silicon: every Mac with an M-series chip, from the original M1 (November 2020) through the M5 generation.
• Apple T2 Security Chip: select Intel Macs from late 2017 through 2020, including the iMac Pro (2017), MacBook Pro (2018 to 2020 Intel), MacBook Air (2018 to 2020 Intel), Mac mini (2018), Mac Pro (2019), and iMac 27-inch (2020).
• Pre-T2 Intel Macs: not supported. A 2015 MacBook Pro cannot be Activation Locked.
• The T1 chip in the 2016 and 2017 Touch Bar MacBook Pros: also not supported. T1 managed the Touch Bar and Touch ID but did not provide the firmware-level enforcement that Activation Lock requires.

This is one of the dividing lines that makes the Apple T2 chip the single biggest determinant of security capability among Intel Macs. A 2017 MacBook Pro and a 2018 MacBook Pro can look nearly identical in a listing photo and live in completely different security worlds.

How the binding actually works#

Activation Lock engages when two conditions are both true on a T2 or Apple silicon Mac: the user is signed in to iCloud, and Find My is on. On these machines, turning on Find My is what turns on Activation Lock. They are two faces of the same system. (Apple Support 102648)

The serial number is registered against that Apple Account in Apple's cloud activation database. After a wipe, when the Mac boots into Setup Assistant and contacts Apple's activation servers, Apple looks up the serial, sees that it is still bound to the previous owner's Apple Account, and instructs the Mac to display the Activation Lock screen. The Mac refuses to continue setup until that Apple Account's password is entered.

The dedicated security processor that holds the identity keys is the other half of the enforcement story. Identity keys for Activation Lock are stored inside the Secure Enclave, sealed against the per-Mac UID fused into the silicon at fabrication. Those keys cannot be read, exported, or reproduced on another chip. Pulling the SSD chips out of an Activation-Locked Mac yields unreadable data because the keys that would decrypt them never leave the Secure Enclave. (Apple Platform Security)

Why a drive wipe does not defeat it#

The lock identity is held on Apple's servers and in the Secure Enclave. Neither of those lives on the user data partition. Erasing the SSD removes user files. It does not remove the serial-to-Apple-Account binding. A full DFU restore through Apple Configurator does not remove it. A logic-board swap usually does not help, and on Apple silicon Macs the SSD is keyed to the Secure Enclave such that swapping the logic board often renders the storage unreadable as well.

The only legitimate ways to clear an Activation Lock:

1. The original owner signs out of iCloud on the Mac (which forces Find My off and clears the lock).
2. The original owner remotely erases the Mac at iCloud.com/find and then chooses Remove from Account.
3. Apple Support clears the lock for someone who can produce an original Apple or authorized-reseller receipt that matches the serial. Private receipts, PayPal screenshots, and chat logs are almost never accepted. (Apple Support)

If the seller is unreachable and there is no receipt, there is no realistic recovery path.

The security-policy preconditions#

Activation Lock only enforces if the Mac's security policy supports it. On Apple silicon, the policy has to be at Full Security (the default). On T2 Macs, Secure Boot has to be at Full Security and external boot has to be disallowed (also defaults). A previous owner who walked Startup Security Utility down to Medium or No Security on a T2 effectively disabled Activation Lock. Worth checking on any used T2 Mac through Recovery's Startup Security Utility, or by running Erase All Content and Settings, which automatically resets the security policy back to Full Security.

How to verify before paying#

Apple no longer offers a public web page to look up a Mac's Activation Lock status by serial number the way it does for iPhone and iPad. Verification has to happen in person at Setup Assistant.

The reliable sequence:

1. Ask the seller to run Erase All Content and Settings with the Mac powered on in front of you. Refuse to pay until this is done.
2. Watch the Mac restart into Setup Assistant. Walk through language, region, and Wi-Fi.
3. A clean Mac continues normally toward creating a user account.
4. The red flag is a screen titled "Activation Lock" asking for "the Apple ID and password that were used to set up this Mac." If that screen appears, stop. The Mac is still tied to the previous owner.

For an extra check, Option-click the Apple menu, open System Information, and look at the Controller pane (Apple silicon or T2). It should report Activation Lock Status: Disabled on a clean Mac.

What this means for buyers#

Activation Lock is the most important barrier to verify on a used Mac, and also the cheapest to verify if the seller meets you in person with a working machine. Five minutes at the kitchen table running Erase All Content and Settings rules it out almost entirely. The risk lives in shipped sales and in any handoff where the seller has not actually wiped the Mac in front of you. If a listing's price seems low and the seller cannot or will not complete a Setup Assistant pass online while you watch, the most likely explanation is the one you do not want to discover after paying.