Image credit: Suzanne Kantra/Techlicious generated by ChatGPT
Simply put:
- Clarkson Law Firm filed a class action against Apple on August 11, alleging fraud and false advertising over iCloud Private Relay, a privacy feature included with iCloud+ subscriptions.
- The suit centers on a still-unpatched flaw that lets some websites see your real IP address even with Private Relay turned on.
- Apple hasn't responded to the lawsuit publicly, and Private Relay remains on and available to subscribers.
Apple is facing a class action lawsuit over a privacy feature that millions of people pay for as part of their iCloud+ subscription. Clarkson Law filed the suit on August 11 saying the feature, called Private Relay, didn't actually keep users' information hidden the way Apple promised. It's the same firm that won a $250 million settlement from Apple earlier this year over delayed Apple Intelligence and Siri features.
If you pay for iCloud+, there's a good chance you're affected. Private Relay is included with those subscriptions and is supposed to hide details like your location from the websites you visit. It works by routing your Safari browsing through two separate relays so your internet provider can only see that you are connected to an Apple server, and websites you visit see a temporary IP address instead of your real one. Private Relay is not a VPN, since it only covers traffic inside Safari rather than everything your device sends, but Apple marketed it as protection against sites and advertisers tracking your location by IP address.
The lawsuit follows an August 4th security disclosure from researchers Tommy Mysk and Talal Haj Bakry, who found several ways websites could still see a user's real information even with Private Relay turned on. The researchers say the flaw isn't limited to Safari. Apple requires every browser on iPhone and iPad, including privacy-focused ones like Tor's OnionBrowser, to run on its WebKit engine, so the same bypass reaches beyond Apple's own browser.
If you're curious how the bug affects your system, the researchers developed a checker tool that shows whether your connection is currently leaking your real IP address.
Apple hasn't issued a public response to the lawsuit. iCloud+ subscribers don't need to do anything to join or track the suit at this stage. In the meantime, if keeping your location private from every site you is important to you, a full VPN will protect all of your device's traffic at the system level, sidestepping this specific flaw.
Read more: The best VPNs for protecting your privacy
