Apple is facing a lawsuit over a privacy feature it has marketed for years as a reliable shield against online tracking. The feature, iCloud Private Relay, is designed to hide a user's IP address and browsing activity while using Safari. Researchers say it does not always do that.
Last week, security researchers Talal Haj Bakry and Tommy Mysk published a blog post describing a vulnerability in the feature. According to CNET, the flaw means that in certain situations, a user's IP address can still be exposed even when Private Relay is turned on. Specifically, the exposure can happen when a user signs in using a passkey or when a website uses two techniques, DNS prefetching and WebTransport, to load content more quickly.
A complaint was filed on August 6 by the Clarkson Law Firm on behalf of plaintiff Edward Rickman, who says he subscribed to iCloud Plus believing that Private Relay would protect his IP address and browsing activity. The filing seeks class action status.
"Instead, Apple delivered a system that recreates through its own credential service the precise harm Apple told the world it had made impossible," the complaint reads.
The lawsuit also seeks an injunction requiring Apple to change its business practices, along with monetary damages and attorneys' fees. An Apple representative did not immediately respond to a request for comment.
iCloud Private Relay is not available on the free version of iCloud. It is a paid feature of iCloud Plus, which costs between 99 cents and $60 per month depending on storage tier. The firm's lawsuit leans on that fact, arguing that users paid specifically for a protection that was not being fully delivered.
Tim Giordano, a partner at Clarkson Law Firm, put it in pointed terms. "Apple built its entire brand on the promise that it would protect its users' privacy when no other company would," he said in a statement. "For Apple's iCloud users to now learn that for years they were paying Apple a premium for a protection that simply didn't work, exposing them to the very tracking, profiling and targeting Apple warned them about, is an outrageous violation and betrayal of consumer trust and law."
The researchers who found the flaw set up a public website where anyone can check whether their IP address is actually being protected. They said they chose to release the information publicly rather than report it to Apple first because of the company's lengthy security review process.
Mysk wrote in an email to CNET, "If we had a better experience with the Apple Security Bounty program that would make us feel confident the issue would be addressed promptly for the benefit of iCloud Private Relay users as well as Psylo users, we would have reported this iCloud Private Relay issue to Apple without having to release a Psylo update addressing the issue, and as a result hav"
Clarkson Law Firm has recent history with Apple. The firm won a $250 million settlement from the company over its marketing of AI features for the iPhone 16 Pro that were never delivered.
