Apple Accused of 'Fraud' in iCloud Private Relay Class Action Lawsuit

Apple is currently embroiled in a proposed class action lawsuit alleging fraud and false advertising concerning a security flaw in its iCloud Private Relay service, as reported by 9to5Mac. The legal action, brought forth by the Clarkson Law Firm, asserts that Apple misled iCloud+ subscribers through its marketing of Private Relay, a feature designed to conceal a user's IP address and DNS records during Safari browsing sessions.

The law firm claims Apple was aware, or should have been aware, that its claims regarding the feature's privacy were false and misleading when it sold the subscriptions. This is not Apple's first legal battle over privacy-related issues; in December 2025, it settled a dispute over the delayed release of personalized Siri features for $250 million, though the specifics of the settlement were not disclosed until May.

Clarkson partner Tim Giordano expressed strong dissatisfaction with Apple's actions, stating that iCloud+ subscribers were charged a premium for a level of protection that failed to materialize, describing it as an "outrageous violation and betrayal of consumer trust and law." The lawsuit zeroes in on several WebKit issues detailed by security researchers earlier this month.

The most critical issue allows a site to circumvent Private Relay's proxy servers by triggering a passkey check directly through the device's operating system, which may not display any passkey prompt, even on websites that merely claim to support passkeys. Additionally, problems with DNS prefetching and the WebTransport protocol introduced in iOS 26 could potentially expose users' actual IP addresses or DNS servers under specific conditions.

As WebKit is integrated into every iOS browser, including Safari, the vulnerability extends beyond Apple's web browser. The Clarkson Law Firm's lawsuit underscores the allegations of Apple's deceptive marketing and the breach of consumer trust, emphasizing the gravity of the alleged fraud.