Apple's iCloud Private Relay Can Actually Expose Your Real IP Address

Emily Long Emily Long Freelance Writer ExperienceEmily Long is a freelance writer based in Salt Lake City. After graduating from Duke University, she spent several years reporting on the federal workforce for Government Executive, a publication of Atlantic Media Company, in Washington, D.C. She has nearly a decade of experience as a freelancer covering tech (including issues related to security, privacy, and streaming) as well as personal finance and travel. In addition to Lifehacker, her work has been featured on Wirecutter, Tom’s Guide, and ZDNET. Emily has also worked as a travel guide around the U.S. and as a content editor. She has a masters in social work and is a licensed therapist in Utah. Read Full Bio August 6, 2026 Add as a preferred source on Google Add as a preferred source on Google Credit: picture alliance via Getty Images Key Takeaways As 404 Media reports, flaws in Apple’s web browser engine allow IP addresses to be revealed when they're supposed to be hidden. Web requests are made outside of the browser and the protections of Private Relay, meaning that websites that support passkeys can see users' real IP addresses If you want to keep your IP address hidden and your data encrypted across all apps and browsers on your device, you may want to consider a separate VPN. Table of Contents If you use iCloud Private Relay, Apple's paid IP address masking service, your internet browsing activity may not actually be private. As 404 Media reports, flaws in Apple’s web browser engine allow IP addresses to be revealed, either maliciously or incidentally, even when they're supposed to be hidden. How Private Relay is exposing IP addressesiCloud Private Relay, which is part of Apple's iCloud+ subscription, is supposed to keep both who you are and what sites you visit hidden when you are browsing in Safari. Without it, your network provider and the websites you view can see your IP address and DNS records, which can be used to track your location and browsing history over time. Private Relay is supposed to encrypt DNS records and generate a temporary IP address, keeping any single party, including Apple, from obtaining both. The issue, discovered by security researchers Talal Haj Bakry and Tommy Mysk, is related to how passkeys work. Web requests are made outside of the browser and the protections of Private Relay, meaning that websites that support passkeys can see users' real IP addresses. Obviously, this impacts Safari traffic, but researchers found the issue in Onion Browser, an iOS app that encrypts traffic through the Tor network. Both 404 Media and TechCrunch verified the issue in their own tests. The researchers stated that they informed Apple but haven't been given a timeline for when the vulnerability will be addressed. Apple is generally pretty good on privacy issues, but this isn't the first to arise in recent months. In July, "Hide My Email," the company's email masking service, was revealed to have a vulnerability that actually exposed users' real email addresses. Apple reportedly knew about it for over a year and claimed to have patched it—but it hadn't. What do you think so far? While Private Relay can be a useful privacy tool—if it works as intended—it's not a true VPN (Virtual Private Network) because it only provides protection when browsing in Safari. If you want to keep your IP address hidden and your data encrypted across all apps and browsers on your device, you may want to consider a separate VPN service. Lifehacker has been a go-to source of tech help and life advice since 2005. Our mission is to offer reliable tech help and credible, practical, science-based life advice to help you live better. Our Mission Our Team Newsletter © 2001-2026 Ziff Davis, LLC., A ZIFF DAVIS COMPANY. ALL RIGHTS RESERVED. Lifehacker is a federally registered trademark of Ziff Davis and may not be used by third parties without explicit permission. The display of third-party trademarks and trade names on this site does not necessarily indicate any affiliation or the endorsement of Lifehacker. If you click an affiliate link and buy a product or service, we may be paid a fee by that merchant.