Apple Sued for Fraud Over iCloud Private Relay Flaw That Exposes Your Real IP Address

Summary

The Clarkson Law Firm filed a class action lawsuit against Apple on August 11, alleging fraud and misrepresentation over iCloud Private Relay. Security researchers discovered that Private Relay, which Apple markets as hiding your IP address from websites while browsing in Safari, fails when a site supports passkeys. In that scenario, your device makes a request outside the browser that bypasses Private Relay entirely, exposing your actual IP. The lawsuit claims Apple knew its privacy claims were false or misleading when it sold iCloud+ subscriptions. Clarkson previously sued Apple over delayed Siri personalization and settled that case for $250 million in December 2025.

Why it matters

Any iCloud+ subscriber who pays for the 200GB, 2TB, or higher plan has been getting Private Relay as part of the package. If you have treated it as meaningful protection while browsing, this flaw matters beyond the courtroom. There is no fix available yet. Checking your iCloud+ settings and understanding what Private Relay actually does right now is a reasonable step.

HTD Says

Apple sold iCloud Private Relay as a meaningful privacy tool, and a newly disclosed flaw shows it does not always hide what it promised to hide, which is a problem worth understanding before Apple has a chance to fix it. Discovering the issue was a good thing. Class Actions maybe not as much. The ones who benefit from a class action are those initial filers and the lawyers supporting them.

While Apple has a massive legal team (and probably a supporting fund), one can only guess that the legal costs will be passed through in one form or another in the future. That being said, identifying this privacy concern is the important part of the news here. While this was discovered a while ago, this lawsuit has brought it into the public eye a bit more.

My hope is that this particular flaw will be rectified soon, as it has supposedly not been corrected yet. As companies push towards using passkeys, it is important that this be resolved, since this privacy protection doesn’t work with passkeys.

Source:

MacRumors