Apple is facing a proposed class-action lawsuit in California federal court, accusing the tech giant of misleading consumers about the privacy protections offered by its premium iCloud+ subscription. The suit, filed by California resident Edward Rickman, centers on the iCloud Private Relay feature, which Apple advertises as a tool to "Hide your IP address and browsing activity in Safari and protect your unencrypted internet traffic."
Customers pay between $0.99 and $59.99 per month for iCloud+ subscriptions, with pricing varying based on storage capacity. However, the lawsuit contends that flaws within Apple's WebKit, the engine powering the Safari browser, allow websites to access users' real IP addresses even when Private Relay is enabled. This, the complaint alleges, directly contradicts Apple's marketing promises.
Tim Giordano, a partner at Clarkson Law Firm, which is leading the litigation, stated that Apple has built its brand on privacy. "For Apple’s iCloud users to now learn that for years they were paying Apple a premium for a protection that simply didn’t work, exposing them to the very tracking, profiling, and targeting Apple warned them about, is an outrageous violation and betrayal of consumer trust and law," Giordano said.
Clarkson Law Firm previously secured a $250 million settlement from Apple earlier this year concerning claims of misleading consumers about Siri's artificial intelligence features. The current lawsuit seeks an injunction against Apple's alleged false marketing, along with attorneys' fees and at least $5 million in relief for class members. This includes all U.S. citizens who subscribed to iCloud+ and activated Private Relay within a specified period.
Apple introduced iCloud Private Relay in June 2021 at its Worldwide Developers Conference, with its release coinciding with an iOS update later that year. During the presentation, Apple claimed the feature would encrypt traffic leaving devices, preventing interception and ensuring that "no one, including Apple, can see both who you are and what sites you’re visiting."
The lawsuit disputes this, alleging that the "dual-relay design" was never structurally sound enough to prevent a single party from identifying both a user and their destination traffic. It further claims that Apple's own passkey system, which uses Touch ID or Face ID for authentication, bypasses the Private Relay, thus exposing user IP addresses. The suit also points to two Apple iOS updates in 2025 and 2026, which it alleges also circumvented Private Relay.
"Year after year, Plaintiff and Class Members paid subscription fees for iCloud+ in reliance on Apple’s representations that Private Relay would hide their IP addresses and browsing activity in Safari," the complaint states. "But instead, Apple delivered a system that recreates through its own credential service that precise harm Apple told the world it had made impossible."
The lawsuit cites a Reddit post from a consumer who expressed distrust, writing, "Don’t trust corporate when it comes to your privacy. The champion of privacy is just an empty brand." This sentiment highlights a broader concern about corporate privacy claims, particularly given Apple's historical positioning as a privacy advocate.
Apple has actively promoted its commitment to user privacy, notably with the introduction of App Tracking Transparency in late 2020. This feature required apps, including Facebook, to obtain explicit user permission before tracking activity across other platforms. Apple CEO Tim Cook defended this initiative, stating, "We believe users should have the choice over the data that is being collected about them and how it’s used." He has also spoken at global privacy summits, emphasizing privacy as a fundamental human right and a core company value.
As of its publication, Apple's website continues to state, "Privacy. That’s Apple."
Apple did not immediately respond to requests for comment.