Apple is facing a class action lawsuit alleging false advertising, misrepresentation, and fraud concerning its iCloud Private Relay feature. This legal action follows recent findings that the service may inadvertently expose users’ real IP addresses, undermining its core privacy promises.
Understanding iCloud Private Relay
iCloud Private Relay is a privacy feature introduced by Apple to protect users’ internet activity in Safari. It operates by routing web traffic through two separate relays: the first, managed by Apple, sees the user’s IP address but not the destination website; the second, operated by a third-party content provider, knows the destination but not the user’s original IP address. This dual-layer system is designed to prevent any single entity from accessing both the user’s identity and browsing activity.
The Identified Vulnerability
Security researchers have discovered that certain web technologies can bypass iCloud Private Relay, leading to the unintended exposure of users’ real IP addresses. Specifically, features like DNS prefetching, WebAuthn origin requests, and WebTransport can circumvent the proxy settings, revealing the user’s actual IP address. This flaw affects all browsers on Apple’s devices due to the mandatory use of the WebKit engine, including privacy-focused browsers like Onion Browser.
Details of the Lawsuit
The class action lawsuit, filed by Clarkson Law Firm, accuses Apple of knowingly misrepresenting the effectiveness of iCloud Private Relay. The firm contends that Apple was aware, or should have been aware, of the service’s shortcomings at the time of its marketing and sale. Tim Giordano, a partner at Clarkson, emphasized the gravity of the situation, stating that Apple built its brand on user privacy promises, and the revelation that users paid for a protection that didn’t function as advertised constitutes a significant breach of consumer trust.
Apple has yet to publicly respond to these allegations. The outcome of this lawsuit could have substantial implications for the company’s privacy commitments and its relationship with consumers. Users concerned about their online privacy should stay informed about this case and consider additional measures to safeguard their internet activity.
