{"id":591471,"date":"2026-08-13T00:28:11","date_gmt":"2026-08-13T00:28:11","guid":{"rendered":"https:\/\/www.newsbeep.com\/ie\/591471\/"},"modified":"2026-08-13T00:28:11","modified_gmt":"2026-08-13T00:28:11","slug":"apple-faces-lawsuit-over-icloud-private-relay-vulnerability","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ie\/591471\/","title":{"rendered":"Apple Faces Lawsuit Over iCloud Private Relay Vulnerability"},"content":{"rendered":"

The revelation that Apple\u2019s iCloud Private Relay feature hasn\u2019t been as secure as Apple says<\/a> has spawned a lawsuit against the iPhone maker.<\/p>\n

Last week, a\u00a0blog post<\/a>\u00a0by Talal Haj Bakry and Tommy Mysk exposed a vulnerability in how iCloud Private Relay, in some circumstances, doesn\u2019t shield a customer\u2019s IP address, which is the entire purpose of the feature. Even when it\u2019s enabled, their\u00a0information can be exposed\u00a0when using a passkey to sign in or when a website uses two methods (DNS prefetching and WebTransport) to load data faster.<\/p>\n

In a\u00a0complaint<\/a>\u00a0filed by Clarkson Law Firm on Aug. 6, plaintiff Edward Rickman says he subscribed to iCloud Plus believing that iCloud Private Relay would hide his IP address and Safari browsing activity.<\/p>\n

\u201cInstead, Apple delivered a system that recreates through its own credential service the precise harm Apple told the world it had made impossible,\u201d reads the complaint, which seeks class action status.<\/p>\n

The lawsuit also seeks an injunction against Apple requiring it to change its business practices to mitigate the risk of consumer deception, as well as monetary relief and attorneys\u2019 fees.<\/p>\n

An Apple representative didn\u2019t immediately respond to a request for comment.<\/p>\n

\"\"Craig Federighi, Apple\u2019s senior vice president of software engineering, describes new privacy features at an Apple event.James Martin\/CNET<\/p>\n

A core component of the lawsuit is that iCloud Private Relay is a paid service of iCloud Plus, which costs between 99 cents and $60 per month. The feature is available only if you\u2019re subscribed to iCloud Plus, not the basic iCloud service.<\/p>\n

Also key is the fact that Apple has advertised for years that iCloud Private Relay is a safe way to browse the web and avoid the types of tracking that services such as Facebook use to connect people\u2019s browsing habits and assemble profiles on them that can be monetized.<\/p>\n

\u201cApple built its entire brand on the promise that it would protect its users\u2019 privacy when no other company would,\u201d Tim Giordano, a partner at Clarkson Law Firm, said in a statement. \u201cFor Apple\u2019s iCloud users to now learn that for years they were paying Apple a premium for a protection that simply didn\u2019t work, exposing them to the very tracking, profiling and targeting Apple warned them about, is an outrageous violation and betrayal of consumer trust and law.\u201d<\/p>\n

Clarkson recently won a\u00a0$250 million settlement<\/a>\u00a0from Apple over the company\u2019s marketing of AI features for the iPhone 16 Pro that were never delivered.<\/p>\n

The researchers who discovered the flaw set up a\u00a0website<\/a>\u00a0that lets anyone check whether iCloud Private Relay is protecting their IP address. They say they released the information publicly rather than first alerting Apple because of the company\u2019s lengthy review process.<\/p>\n

\"AThe information in the red box was the IP number of my home router.Screenshot by Jeff Carlson\/CNET<\/p>\n

In an email to CNET, Mysk wrote, \u201cIf we had a better experience with the Apple Security Bounty program that would make us feel confident the issue would be addressed promptly for the benefit of iCloud Private Relay users as well as Psylo users, we would have reported this iCloud Private Relay issue to Apple without having to release a Psylo update addressing the issue, and as a result having to disclose it to our users.\u201d Psylo is the developers\u2019 privacy-focused web browsing app.<\/p>\n

\t\t\t\t\t\t\t\"Jeff\t\t\t\t\t\t<\/p>\n

\n\t\t\t\t\t\t\tJeff Carlson\n\t\t\t\t\t\t<\/p>\n

\t\t\t\t\t\t\tSenior Writer\t\t\t\t\t\t<\/p>\n

\t\t\t\t\t\t\t\t\t\t\tJeff Carlson writes about mobile technology at CNET, from cellular phone plans to devices and emerging technology.
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\tSee full bio\t\t\t\t\t<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"The revelation that Apple\u2019s iCloud Private Relay feature hasn\u2019t been as secure as Apple says has spawned a…\n","protected":false},"author":2,"featured_media":591472,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[61,60,80],"class_list":["post-591471","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-ie","tag-ireland","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/591471","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=591471"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/591471\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/591472"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=591471"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=591471"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=591471"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}