Apple is facing a proposed class-action lawsuit over alleged privacy failures involving its iCloud Private Relay service. The case claims technical flaws could expose information that the service aims to protect during web browsing.
Clarkson Law Firm filed the lawsuit and accused Apple of misleading customers through its marketing of iCloud+ subscriptions. The firm argues that customers paid for stronger privacy protections but did not always receive the level of protection they expected.
The same law firm previously handled litigation involving Apple’s delayed Siri AI features. That earlier case reached a settlement in December 2025, with $250 million settlement details reported in May 2026.
WebKit Flaws Raise Privacy Concerns
The latest dispute follows an August 4 report about potential leaks involving WebKit and iCloud Private Relay. Apple requires browsers on iPhone to use WebKit, meaning the reported issues could affect multiple iOS browsers rather than Safari alone.
According to the report, several technologies could reveal information even when users rely on a proxy or Private Relay. These include DNS prefetching, WebAuthn for Passkeys, and WebTransport.
For example, DNS prefetching in iOS 26 could resolve hostnames through a normal DNS route instead of the proxy. As a result, some browsing information could become exposed. Meanwhile, the WebAuthn Passkey validation process reportedly revealed IP addresses. WebTransport could also expose an IP address when establishing a direct HTTP/3 connection.
What the Case Could Mean for Apple
Private Relay plays an important role in Apple’s broader privacy strategy. Therefore, allegations that the service failed to provide its advertised protection could create both technical and legal challenges.
However, the lawsuit remains an allegation rather than a finding that Apple violated the law. Apple had not commented on the case at the time covered by the source.
The reported WebKit issues may now become important evidence as the case develops. Apple will also need to address the underlying technical concerns, according to the report.
For users, the dispute highlights a wider challenge facing privacy services: strong marketing promises must also hold up when browsers, network protocols, and authentication technologies interact in real-world conditions.
