Security researchers last week revealed a flaw in Apple’s iCloud Private Relay feature. While this is supposed to protect your IP address from the websites you visit, a vulnerability means that it often fails to do so.
Any time there’s a problem with an Apple product or service, a class action lawsuit is sure to follow, and this is no exception …
As we’ve explained previously, iCloud Private Relay isn’t quite a VPN, but it is intended to fulfil a similar privacy function in terms of preventing your web usage being tracked when you are using Safari as your browser. Here’s how Apple describes it:
In other words, your ISP sees only that you are accessing an Apple server, and the website you visit sees only an IP address generated by that server.
Security researchers found that any website that supports passkeys can see your real IP address.
In a quirk of how passkeys work, a user’s device makes a web request outside of the browser itself. Meaning, that request essentially bypasses Private Relay and exposes a user’s real IP address, even though to them it may look like they are simply interacting with a website as normal.
Worse, it doesn’t even matter whether the website actually supports passkeys: just pretending it does so will reveal your IP address.
A class action lawsuit accusing Apple of false advertising, misrepresentation, and fraud has now been filed by Clarkson Law Firm – the same lawyers who previously obtained a $250M settlement over the delayed launch of Siri AI.
[Apple] knew, or should have known, that the Challenged Representations were false, misleading, deceptive, and unlawful, at the time that Defendant manufactured, marketed, advertised, labeled, and sold the [iCloud+] Subscriptions.
Tim Giordano, a partner at Clarkson, told us the firm considers it an “outrageous betrayal of consumer trust.”
“Apple built its entire brand on the promise that it would protect its users’ privacy when no other company would. For Apple’s iCloud users to now learn that for years they were paying Apple a premium for a protection that simply didn’t work, exposing them to the very tracking, profiling, and targeting Apple warned them about, is an outrageous violation and betrayal of consumer trust and law.”
We’ve reached out to Apple for comment and will update with any response.
FTC: We use income earning auto affiliate links. More.
Check out 9to5Mac on YouTube for more Apple news:
Breaking news from Cupertino. We’ll give you t…
Privacy is a growing concern in today's world. F…
Ben Lovejoy is a British technology writer and EU Editor for 9to5Mac. He’s known for his op-eds and diary pieces, exploring his experience of Apple products over time, for a more rounded review. He also writes fiction, with two technothriller novels, a couple of SF shorts and a rom-com!
