Back to Apple

Apple - Lawsuit

moderateAnti-Privacy → Lawsuit

Executive Summary

Apple is facing a class-action lawsuit after researchers discovered that its paid iCloud Private Relay feature fails to hide users' IP addresses in certain situations, including when using passkeys or when websites employ specific data-loading methods. The plaintiff claims he paid for iCloud Plus specifically to protect his browsing privacy, but the service failed to deliver the promised protection against tracking and profiling. The lawsuit seeks to force Apple to change its practices and pr...

What Happened

Researchers discovered that Apple's iCloud Private Relay, a paid privacy feature within iCloud Plus subscriptions, fails to hide users' IP addresses in certain situations, including when using passkeys for authentication or when websites employ DNS prefetching and WebTransport data-loading methods. On August 6, 2024, a class-action lawsuit was filed by plaintiff Edward Rickman claiming he paid for iCloud Plus specifically for IP address protection that the service failed to deliver. The researchers publicly disclosed the vulnerability and created a website allowing users to test whether their IP addresses remain exposed.

Who Is Affected

All iCloud Plus subscribers who have been paying between 99 cents and $60 monthly for the service are potentially affected, particularly those who relied on Private Relay to prevent tracking and profiling while browsing. Users who authenticate to websites using passkeys or visit sites that use specific data-loading optimization methods have had their IP addresses exposed despite believing they were protected. The flaw has existed for years according to the lawsuit, meaning long-term subscribers have been continuously vulnerable to the tracking Apple explicitly promised to prevent.

Why It Matters

This case represents a significant breach of trust from a company that has built its brand identity around privacy protection and explicitly warned users about tracking risks from services like Facebook. Unlike free privacy tools, iCloud Private Relay is a paid service where consumers specifically purchased protection that failed to work as advertised for years. The lawsuit follows a recent $250 million settlement against Apple over undelivered AI features, suggesting a pattern of marketing promises that don't match product reality, which could undermine consumer confidence in paid privacy services across the industry.

What You Should Do

If you subscribe to iCloud Plus for Private Relay, visit the researchers' testing website to check whether your IP address is actually being protected. Consider whether the privacy protection justifies your subscription cost given these revealed limitations, particularly if you frequently use passkeys for authentication. Review your browsing habits and consider supplementing or replacing Private Relay with alternative privacy tools such as reputable VPN services until Apple addresses these vulnerabilities. If you feel you paid for protection you didn't receive, monitor the class-action lawsuit for potential eligibility to join the case.

Summary generated from verified sources and reviewed before publication. How we summarize.

Sources

Related Events

Apple is facing a class-action lawsuit after researchers discovered that its... - Apple | PrivacyWire