Recently uncovered bugs in Private Relay and Hide My Email have exposed a glaring truth: no single company can act as your sole privacy shield
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
For years, many assumed that buying an Apple device guaranteed out-of-the-box privacy protection. However, this reputation is beginning to unravel.
Last week, researchers found that Apple’s iCloud Private Relay tool — a paid add-on feature that encrypts Safari browser traffic to hide a user's IP address — could leak the very detail it’s expected to protect.
These revelations come about a month after 404 Media reported that Hide My Email, another feature included in the paid iCloud+ subscription, also leaked users’ real email addresses. While Apple has now issued a patch, it only did so after the news broke, despite reportedly being aware of the flaw for at least one year.
The situation raises a critical question: can 'marketing privacy’ ever match technical reality? And if we cannot rely solely on Apple’s tools, what can we do to really protect our privacy online?
Apple markets iCloud Private Relay as a feature designed to protect your privacy. By securing your traffic when you browse on Safari, the company claims that "no single party — not even Apple — can see both who you are and what sites you're visiting."
To achieve this, the feature is supposed to route your requests through two separate proxy servers, or relays. This means that the second relay — the one that connects you to the website — can't see your real IP address or original DNS request.
That is what should happen in theory. However, recent findings by security researchers Talal Haj Bakry and Tommy Mysk suggest otherwise.
The iOS developers came across a series of issues in Apple's web browser engine by chance. In June, a user of their Psylo browser — a privacy-first app for iPhone and iPad specifically designed to defeat browser fingerprinting — contacted them to report DNS leaks.
While iCloud Private Relay functions as a proxy limited to Safari browsing, a VPN operates at the operating system level. By encrypting network traffic across the entire device rather than just a single browser, a VPN ensures that all application data, background processes, and connections are protected behind a system-wide encrypted tunnel.
Not only did the duo identify the origin of the DNS exposure, but they also found two additional leaks while investigating. Crucially, neither leak was the fault of their own app. “The problem is not within our implementation, but it’s a systemwide issue in the iOS infrastructure,” Mysk told TechRadar.
The first vulnerability involves DNS prefetching, a feature designed to speed up browsing. According to their tests, Safari was incorrectly resolving domain queries outside the secure proxy tunnel, leaking a user’s real DNS server.
The second leak is more troubling and concerns what’s known as WebTransport, a protocol designed to enable faster communication between a web browser and a website. Researchers found it was exposing the user’s real IP address — the very detail users believed they were masking by using Private Relay.
Similarly, Bakry and Mysk discovered that the passkey system — the framework that allows for passwordless logins — also bypasses the proxy and reveals users’ real IPs.