Apple sued for fraud over iCloud Private Relay vulnerability exposing user data

A class-action lawsuit has been filed against Apple over privacy claims tied to its iCloud Private Relay service. The law firm Clarkson Law Firm accuses the company of fraud and false advertising, arguing that iCloud+ subscribers paid for protection that did not actually work.

Private Relay was marketed as a feature that hides a user's IP address and DNS queries while browsing in Safari. However, the plaintiffs claim Apple knew or should have known that its security promises did not match reality. As a result, customers overpaid for years for a function that failed to deliver the advertised level of privacy.

Clarkson partner Tim Giordano said Apple built its reputation on promises to protect users but broke that trust. In his words, consumers paid extra for protection that did not function and were exposed to the same tracking, profiling, and targeted ads that Apple itself warned them about.

The lawsuit cites WebKit vulnerabilities recently documented by cybersecurity researchers. The most serious one involves the passkey system: a website can trigger a key verification that is handled by the device's operating system rather than Safari, bypassing Private Relay proxy servers. In some cases, this happens without any user notification, even if the site merely claims passkey support.

Two other issues relate to DNS-prefetching and the WebTransport protocol introduced in iOS 26. These can expose a user's real IP address or DNS servers under certain conditions. Since WebKit powers all browsers on iOS, the risk extends beyond Safari.

Clarkson Law Firm has previously taken on Apple, settling a case over delayed personalized Siri features. That dispute ended with a $250 million agreement in December 2025, though payment details only emerged in May 2026.

The current lawsuit strikes at a core part of Apple's image — user privacy protection. Lawyers stress that clients paid for a service that did not meet its stated specifications, which could have serious implications for the company.