Apple is facing a proposed class action lawsuit over iCloud Private Relay, with the complaint accusing the company of fraud, false advertising, and misleading customers about the privacy protection included with iCloud+ subscriptions.
9to5Mac reports that Clarkson Law Firm filed the lawsuit after security researchers identified WebKit flaws that can expose a user’s real IP address or DNS information despite Private Relay being enabled. The complaint alleges that Apple “knew, or should have known” that its claims about the service were false or misleading when it marketed and sold iCloud+ subscriptions.
Don’t miss the best of The Mac Observer
Set us as a preferred source and our Apple reporting ranks higher in your Google Search results and Discover feed — one tap, no account changes.
Private Relay is designed to protect Safari browsing by separating information about a user’s identity and the websites they visit. Apple handles the first relay, while a third-party provider handles the second, preventing either party from seeing the complete browsing request.
Private Relay flaw can expose a user’s real IP address
The most serious reported flaw involves passkeys, as a website can trigger a passkey-related request that the operating system handles outside Safari and therefore outside Private Relay’s proxy servers. Researchers found that a website can potentially expose the real IP address without displaying a passkey prompt, including when the site only claims to support passkeys.
Researchers also identified issues involving DNS prefetching and WebTransport, which Apple added with iOS 26, that can expose real IP addresses or DNS servers under certain conditions. Because Apple requires browsers on iOS to use WebKit, the underlying exposure is not limited to Safari.
Clarkson partner Tim Giordano said customers paid Apple for privacy protection that failed to provide the protection they expected.
“For Apple’s iCloud users to now learn that for years they were paying Apple a premium for a protection that simply didn’t work… is an outrageous violation and betrayal of consumer trust and law.”
Clarkson previously represented plaintiffs in litigation over Apple’s delayed personalized Siri features, which ended with a $250 million settlement in December 2025. The new Private Relay lawsuit remains a proposed class action, and Apple has not provided a response in the supplied material.
Discussion