Security researchers last week revealed a flaw in Apple’s iCloud Private Relay feature. While this is supposed to protect your IP address from the websites you visit, a vulnerability means that it often fails to do so.

Any time there’s a problem with an Apple product or service, a class action lawsuit is sure to follow, and this is no exception …

As we’ve explained previously, iCloud Private Relay isn’t quite a VPN, but it is intended to fulfil a similar privacy function in terms of preventing your web usage being tracked when you are using Safari as your browser. Here’s how Apple describes it:

• Your IP address is visible to your network provider and to the first relay, which is operated by Apple. Your DNS records are encrypted, so neither party can see the address of the website you’re trying to visit.
• The second relay, which is operated by a third-party content provider, generates a temporary IP address, decrypts the name of the website you requested, and connects you to the site.

In other words, your ISP sees only that you are accessing an Apple server, and the website you visit sees only an IP address generated by that server.

Security researchers found that any website that supports passkeys can see your real IP address.

In a quirk of how passkeys work, a user’s device makes a web request outside of the browser itself. Meaning, that request essentially bypasses Private Relay and exposes a user’s real IP address, even though to them it may look like they are simply interacting with a website as normal.

Worse, it doesn’t even matter whether the website actually supports passkeys: just pretending it does so will reveal your IP address.

A class action lawsuit accusing Apple of false advertising, misrepresentation, and fraud has now been filed by Clarkson Law Firm – the same lawyers who previously obtained a $250M settlement over the delayed launch of Siri AI.

[Apple] knew, or should have known, that the Challenged Representations were false, misleading, deceptive, and unlawful, at the time that Defendant manufactured, marketed, advertised, labeled, and sold the [iCloud+] Subscriptions.

Tim Giordano, a partner at Clarkson, told us the firm considers it an “outrageous betrayal of consumer trust.”

“Apple built its entire brand on the promise that it would protect its users’ privacy when no other company would. For Apple’s iCloud users to now learn that for years they were paying Apple a premium for a protection that simply didn’t work, exposing them to the very tracking, profiling, and targeting Apple warned them about, is an outrageous violation and betrayal of consumer trust and law.”

We’ve reached out to Apple for comment and will update with any response.

• Certified refurbished Apple products 15% off at apple.com
• Official Apple Store on Amazon
• Discounted AirPods Pro 3
• Wireless CarPlay adapter
• AirTag holders and accessories
• Mac Pro-style Mac mini casing