MacSouverain

FREN
radar

Apple Private Relay protects you from nothing

A large share of iCloud+ subscribers take Private Relay for a tunnel. Three WebKit leaks say otherwise, and Apple is being sued for fraud.

The fact


The American law firm Clarkson Law Firm has just filed a class action against Apple. The charge is blunt, fraud and false advertising over iCloud Private Relay, the feature included in iCloud+ that Apple presents as a shield for your browsing. The same firm wrested a $250 million settlement from Apple in December 2025 over the Siri case. This is not a weekend litigator.


The technical backbone of the complaint comes from elsewhere. Two researchers, Tommy Mysk and Talal Haj Bakry, documented three mechanisms through which your real IP address or your DNS servers can leak even while Private Relay is active. Proton relayed their work on August 5.

The three leaks are all on the WebKit side, the engine of Safari. One, passkey connections entirely bypass the relay servers. Two, DNS prefetching reveals your real DNS servers. Three, the WebTransport protocol, a brick added to WebKit with iOS 26 (the current stable version), exposes your real IP address under certain conditions.


Two things to keep cool-headed. A lawsuit is allegations, not a judgment. And at this stage Apple says it is investigating without announcing any fix or timeline, no exploitation in the wild is documented. The problem isn’t that your data is being stolen this morning, it’s the gap between what the feature suggests and what it actually delivers.


Why it matters to you


Private Relay is not a VPN. That’s the sentence to remember. A large share of iCloud+ subscribers turn it on thinking they’re switching on a tunnel that masks all their traffic. Wrong. Private Relay only covers Safari and a fraction of system traffic, your address goes through a double hop, an Apple server then a partner, so that no one sees both who you are and where you’re going. Elegant on paper. Except the three leaks break that contract inside its own perimeter, on the very part it’s supposed to protect, your IP or your DNS can slip out in the clear.


Concretely. A passkey connection, and the relay is short-circuited. A DNS prefetch triggered by a page, and your real DNS servers appear. WebTransport, arrived with iOS 26, and your real IP address shows itself. You did nothing special, the leak comes from the engine, not from you. These mechanisms are named and testable, this is not barstool theory.


Nuance, because Mac Souverain doesn’t deal in easy alarm. Your account isn’t hacked, your pages aren’t being read, there’s no mass leak. What falls is the anonymity of your IP while browsing, precisely what you thought you were turning the feature on for.

Technically, Private Relay never promised to be a VPN. It’s the soft-touch marketing that lets the doubt settle in, and a large share of users take the relay for a tunnel. It’s the same pattern as the Apple alias that lets your real address be traced back, a privacy feature sold as protection, a flaw that empties it of its promise.


What you do now


1. Stop treating Private Relay like a VPN. It’s a double-hop relay for Safari, not a system tunnel. Keep it if you want, but don’t entrust it with what it doesn’t protect.


2. To really mask your IP across all your traffic, get a real no-log VPN in a sane jurisdiction, Proton VPN or Mullvad, paired with a sovereign DNS. There you hold a tunnel, not a half-relay.


Read also: DNS, the Achilles’ heel of your digital sovereignty


3. Test it yourself. With Private Relay on, go to dnsleaktest.com or dnscheck.tools and watch what comes out. The best antidote to marketing is your own verification.


4. Watch what comes next. Apple is investigating with no timeline, consider no leak plugged until it’s publicly verified, not on the word of a release note.


Sources