Apple's Private Relay can leak your real IP address, researchers find

Apple’s Private Relay, an opt-in feature designed to hide a user’s IP address while browsing with Safari, can be circumvented to reveal that address because of a series of flaws, researchers Talal Haj Bakry and Tommy Mysk revealed in a blog post Tuesday. The issue was first reported by 404 Media. The researchers set up a website where anyone can check whether their real IP address leaks even while using Private Relay, and TechCrunch verified on Tuesday that the site was able to reveal its real IP address.

Bakry and Mysk wrote that the problem lies in three features of WebKit, Apple’s web browser engine, which is used by every browser on iOS. Private Relay is available only to iCloud+ subscribers and works only while using Safari — unlike a virtual private network (VPN), which protects a user’s IP address at the system level regardless of which app or browser is being used.

Mysk said on X that he and his colleagues chose not to report the issue to Apple first, writing: “Our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue’s impact entirely.” Apple did not immediately respond to a request for comment.

Mysk and his colleagues also develop a private browser called Psylo, which they say now includes mitigations that prevent users’ IP addresses from leaking while using it.

Why it matters

The flaws undercut one of the main selling points of an iCloud+ subscription — that Private Relay hides a user’s IP address from trackers — for anyone who assumed it worked as reliably as a dedicated VPN.