Apple sued over iCloud+ Hide My Email flaw allegedly exposing users' real addresses

James Cirrone Fri, July 17, 2026 at 11:06 AM PDT | 2 min read

• AAPL +0.14%

Apple is facing a proposed class action lawsuit alleging that its "Hide My Email" feature failed to conceal users' real email addresses from websites and apps.

The complaint, filed Wednesday in federal court, also claimed Apple was aware the feature — introduced in 2019 — was not working as early as last summer and did not take sufficient action to fix it.

According to the suit, the alleged issue still has not been remedied, even as Apple continues to claim that "Hide My Email" generates "unique, random email addresses" that forward to a user's personal inbox so their real email address is "kept private."

An Apple store in Munich, Germany, on September 19, 2019.

Related: Apple Accuses OpenAI of Telling Recruits to Bring Apple Prototypes to Interviews

"A vulnerability in the implementation of Hide My Email allows almost anyone, without elevated privileges or insider access, to link a Hide My Email alias back to the user's real email address. Independent testing found that 100% of the aliases examined were exploitable," according to the lawsuit.

Apple offers "Hide My Email" in two ways:

• Through Sign in with Apple, where users can mask their address when creating accounts online.
• Through paid iCloud+ subscriptions, which let users generate private relay addresses more broadly.

Read on the Fox Business App

The lawsuit was filed by Anthony Alvarez, a San Diego resident who claims he was "one of the millions of customers" who paid for an iCloud+ subscription with the expectation that his email address would be kept private.

The feature, as advertised, protects users from spam emails, stops their data from being sold to data brokers, and prevents their information from being exposed in a third-party data breach.

The iOS Mail app on an iPhone.

Related: Apple to Invest $30 Billion in US Chip Manufacturing

A security researcher found a flaw in the feature in June 2025 and reported it to Apple, per the lawsuit.

• One month later, Apple acknowledged the bug.
• By March, Apple said it had "addressed the reported issue in a recent system change," the lawsuit said.
• After the researcher told Apple the bug was still present, the company said in May that it would release a patch within a few weeks, according to the suit.

That never happened, the lawsuit said, which prompted the researcher to go public about the "Hide My Email" vulnerability.

Aerial shot of Apple Park, the headquarters of Apple Inc., in Cupertino, California.

Click Here to Download the Fox News App

If the judge agrees that thousands — or potentially millions — of people were affected by the alleged security flaw, the lawsuit could move forward as a class action.

The lawsuit does not demand a specific dollar amount in compensation but seeks money for customers who paid for Apple privacy protections that allegedly did not work as promised.

Fox News Digital reached out to Apple for comment on the lawsuit.

Original article source: Apple hit with lawsuit claiming iCloud+ privacy tool could expose users' real emails to websites

View Comments