Apple is facing a new class action lawsuit alleging fraud, false advertising, and misrepresentation related to a recently disclosed vulnerability in its iCloud Private Relay feature.
According to 9to5Mac, security researchers revealed last week that iCloud Private Relay — a privacy tool meant to hide users’ real IP addresses from websites when browsing in Safari — often fails to do so. The feature routes traffic through two relays so that a user’s internet service provider sees only a connection to an Apple server, while the destination website sees only a temporary IP address generated by a third-party relay.
The flaw stems from how passkeys work. When a website supports (or even pretends to support) passkeys, the user’s device makes a web request outside the browser. That request bypasses Private Relay and can expose the real IP address. Researchers noted that simply claiming passkey support is enough to trigger the leak.
The lawsuit, filed by Clarkson Law Firm (the same firm that previously secured a $250 million settlement related to Apple Intelligence and Siri delays) claims Apple “knew, or should have known” that its marketing representations about Private Relay were “false, misleading, deceptive, and unlawful” when it sold iCloud+ subscriptions.
Tim Giordano, a partner at the firm, described the situation as “an outrageous betrayal of consumer trust,” stating that Apple built its brand on protecting user privacy and that subscribers paid a premium for protection that did not work as advertised, leaving them exposed to the tracking Apple had warned against.
iCloud Private Relay remains available to iCloud+ subscribers as a Safari privacy feature.
MacDailyNews Take: Wholly expected. Get ready for a settlement, eligible iCloud+ subscribers.
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!
Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.