Add The New York Post on Google A California man is suing Apple in a proposed class-action lawsuit for allegedly misleading consumers about the privacy benefits of iCloud’s paid subscription tier – saying it falsely claimed that users’ IP addresses would be hidden.
Edward Rickman said he purchased iCloud+ for access to iCloud Private Relay, a feature that Apple promises will “Hide your IP address and browsing activity in Safari and protect your unencrypted internet traffic,” according to a suit filed last week in California federal court.
Apple charges customers between $0.99 to $59.99 a month for the premium iCloud subscription, depending on how much storage they wanted, according to its website.
But three flaws in Apple’s WebKit, which powers the Safari browser, allowed websites to access users’ real IP addresses even when the premium feature was switched on, the lawsuit alleged.
“Apple built its entire brand on the promise that it would protect its users’ privacy when no other company would,” Tim Giordano, a partner at Clarkson Law Firm, which is leading the litigation, told The Post.
“For Apple’s iCloud users to now learn that for years they were paying Apple a premium for a protection that simply didn’t work, exposing them to the very tracking, profiling, and targeting Apple warned them about, is an outrageous violation and betrayal of consumer trust and law.”
Earlier this year, Clarkson Law Firm secured a $250 million settlement from Apple over claims it misled consumers on Siri’s AI features.
The lawsuit is seeking an injunction on Apple’s alleged false marketing, along with attorneys’ fees and relief of at least $5 million for all members of the class. That includes all US citizens who paid for iCloud+ and enabled Private Relay within a certain time frame.
Apple first unveiled iCloud Private Relay at its annual Worldwide Developers Conference in June 2021, releasing it later that year as part of an iOS update.
During that presentation, Apple claimed that Private Relay “ensures that the traffic leaving your device is encrypted so that no one can intercept and read it” and that “no one, including Apple, can see both who you are and what sites you’re visiting,” according to a recording.
“But in reality, Apple’s promise that Private Relay’s dual-relay design made it structurally impossible for any single party to see both a user identity and the destination of their traffic has never been true,” the lawsuit alleged.
Apple’s own operating system uses passkeys – a Touch ID or Face ID scan that replaces typed passwords – and these are never routed through the relay that Apple designed to prevent IP addresses from accessing private information, according to the suit.
Two recent Apple iOS updates in 2025 and 2026 also bypassed Private Relay, exposing the user’s IP address, the suit said.
“Year after year, Plaintiff and Class Members paid subscription fees for iCloud+ in reliance on Apple’s representations that Private Relay would hide their IP addresses and browsing activity in Safari,” the complaint said.
“But instead, Apple delivered a system that recreates through its own credential service that precise harm Apple told the world it had made impossible.”
Charlie Gasparino has his finger on the pulse of where business, politics and finance meet Sign up to receive On The Money by Charlie Gasparino in your inbox every Thursday.
In a post on Reddit, which was cited in the lawsuit, one frustrated consumer wrote, “Don’t trust corporate when it comes to your privacy. The champion of privacy is just an empty brand.”
More than just boasting about the capabilities of its Private Relay feature, Apple also spent years positioning itself as a leading consumer tech firm for privacy compared to its rivals, the lawsuit alleged.
In late 2020, Apple introduced App Tracking Transparency, a privacy feature that required apps like Facebook to ask for explicit permission before tracking users’ activity across other sites, the lawsuit noted.
Facebook responded by launching full-page ads in newspapers arguing that the new tracking rules were “about profit, not privacy” and would ultimately harm small businesses.
Apple CEO Tim Cook defended the update against Facebook’s arguments in a post on X, writing, “We believe users should have the choice over the data that is being collected about them and how it’s used.”
In the summer of 2022, Cook spoke at a global privacy summit and invoked late privacy scholar Alan Westin, saying “while the erosion of privacy was a legitimate fear, it was not an inevitable consequence of technology,” according to the lawsuit.
As of publishing, Apple’s website states: “Privacy. That’s Apple.”
“Privacy is a fundamental human right. It’s also one of our core values. Which is why we design our products and services to protect it. That’s the kind of innovation we believe in,” the company said.
Apple did not immediately respond to The Post’s request for comment.
