Overview
- A proposed class-action complaint was filed in the U.S. District Court for the Northern District of California on Aug. 11 alleging false advertising, misrepresentation and fraud over iCloud Private Relay.
- Security researchers published early-August proof-of-concept findings that show multiple WebKit behaviors—DNS prefetching, WebTransport and a WebAuthn/passkey flow—can send traffic outside Private Relay and expose real IP addresses.
- The most serious issue involves passkey validation handled by the device operating system that can make network requests outside the browser proxy path and that a website can trigger simply by claiming to support passkeys.
- Apple has not publicly responded to the lawsuit and is reported to be investigating the disclosures with software patches planned for upcoming iOS and macOS releases, while researchers advise users who need device-level IP hiding to use a system VPN as a short-term fix.
- The case is brought by the Clarkson Law Firm, which won a $250 million settlement against Apple over Siri AI delays, and it frames the dispute as a challenge to Apple’s core privacy marketing with possible reputational and financial consequences.