Advanced Data Protection OFF --> Apple has the decryption key for your data in iCloud
Advanced Data Protection ON --> The encryption key is kept on your devices only (and icloud.com doesn't work without prior authorisation/key exchange from you, and then only for a specified time)
More info: