Apple is facing a lawsuit over its iCloud Private Relay feature after researchers demonstrated that the tool does not always conceal a customer’s IP address, which is its central purpose. The complaint follows a public disclosure that revealed the feature could expose user information in certain circumstances.
Researchers Talal Haj Bakry and Tommy Mysk published findings showing that iCloud Private Relay, in some cases, fails to shield a user’s IP address even when enabled. Exposure can occur when a passkey is used to sign in, or when a website relies on two methods, DNS prefetching and WebTransport, to load data more quickly.
The claims against Apple
Clarkson Law Firm filed the complaint on 6 August on behalf of plaintiff Edward Rickman, who subscribed to iCloud Plus in the belief that iCloud Private Relay would hide his IP address and Safari browsing activity. The complaint states that Apple instead delivered a system that recreates, through its own credential service, the precise harm Apple said it had made impossible.
The filing seeks class action status, an injunction requiring Apple to change its business practices to reduce the risk of consumer deception, monetary relief and attorneys’ fees. A core element of the suit is that iCloud Private Relay is a paid feature available only to iCloud Plus subscribers, with plans costing between roughly 80p and £47 per month. The feature is not offered with the basic iCloud service.
Marketing and privacy promises
The complaint also focuses on Apple’s long-standing advertising of iCloud Private Relay as a safe way to browse the web and avoid tracking of the kind used by services such as Facebook to build and monetise user profiles. Tim Giordano, a partner at Clarkson Law Firm, said Apple built its brand on the promise of protecting user privacy, and described the situation as a violation and betrayal of consumer trust and law.
Clarkson recently secured a EUR 217 million settlement (about £198 million) from Apple over the marketing of AI features for the iPhone 16 Pro that were never delivered.
How the flaw was disclosed
The researchers who found the flaw created a website that lets anyone check whether iCloud Private Relay is protecting their IP address. They said they released the information publicly rather than alerting Apple first, citing the company’s lengthy review process. Mysk stated that a better experience with the Apple Security Bounty programme would have prompted them to report the issue to Apple beforehand. Apple did not immediately respond to a request for comment.
