The revelation that Apple’s iCloud Private Relay feature hasn’t been as secure as Apple says has spawned a lawsuit against the iPhone maker.
Last week, a blog post by Talal Haj Bakry and Tommy Mysk exposed a vulnerability in how iCloud Private Relay, in some circumstances, doesn’t shield a customer’s IP address, which is the entire purpose of the feature. Even when it’s enabled, their information can be exposed when using a passkey to sign in or when a website uses two methods (DNS prefetching and WebTransport) to load data faster.
In a complaint filed by Clarkson Law Firm on Aug. 6, plaintiff Edward Rickman says he subscribed to iCloud Plus believing that iCloud Private Relay would hide his IP address and Safari browsing activity.
“Instead, Apple delivered a system that recreates through its own credential service the precise harm Apple told the world it had made impossible,” reads the complaint, which seeks class action status.
The lawsuit also seeks an injunction against Apple requiring it to change its business practices to mitigate the risk of consumer deception, as well as monetary relief and attorneys’ fees.
An Apple representative didn’t immediately respond to a request for comment.
A core component of the lawsuit is that iCloud Private Relay is a paid service of iCloud Plus, which costs between 99 cents and $60 per month. The feature is available only if you’re subscribed to iCloud Plus, not the basic iCloud service.
Also key is the fact that Apple has advertised for years that iCloud Private Relay is a safe way to browse the web and avoid the types of tracking that services such as Facebook use to connect people’s browsing habits and assemble profiles on them that can be monetized.
“Apple built its entire brand on the promise that it would protect its users’ privacy when no other company would,” Tim Giordano, a partner at Clarkson Law Firm, said in a statement. “For Apple’s iCloud users to now learn that for years they were paying Apple a premium for a protection that simply didn’t work, exposing them to the very tracking, profiling and targeting Apple warned them about, is an outrageous violation and betrayal of consumer trust and law.”
Clarkson recently won a $250 million settlement from Apple over the company’s marketing of AI features for the iPhone 16 Pro that were never delivered.
The researchers who discovered the flaw set up a website that lets anyone check whether iCloud Private Relay is protecting their IP address. They say they released the information publicly rather than first alerting Apple because of the company’s lengthy review process.
In an email to CNET, Mysk wrote, “If we had a better experience with the Apple Security Bounty program that would make us feel confident the issue would be addressed promptly for the benefit of iCloud Private Relay users as well as Psylo users, we would have reported this iCloud Private Relay issue to Apple without having to release a Psylo update addressing the issue, and as a result having to disclose it to our users.” Psylo is the developers’ privacy-focused web browsing app.
See full bio