Apple is facing a proposed class action lawsuit that accuses the company of misleading iCloud+ subscribers about the privacy protections offered by its Hide My Email feature.
The lawsuit, filed after 404 Media disclosed a vulnerability in the service, alleges that the feature fails to conceal users’ real email addresses from websites despite Apple’s marketing claims. Tyler Murphy, co-founder of EasyOptOuts, discovered the flaw in June 2025 and reported it to Apple with detailed replication instructions.
Apple acknowledged the report but took more than a year to address it. In March 2026 the company said it had fixed the issue with a “recent system change,” but Murphy found the flaw remained exploitable. He provided further information, and Apple said it was still investigating. By late May, Apple said it expected to ship a fix “in the coming weeks.”
The vulnerability allows anyone to uncover the real email address behind a Hide My Email alias. Free people-search databases can then tie that address to a person’s other personal details. The lawsuit seeks compensation for customers who paid for iCloud+ privacy protections that allegedly did not work as promised.
404 Media verified the flaw this month using one of its own Hide My Email addresses. In tests with volunteers, 100% of aliases were found to be exploitable. Apple did not immediately comment on the lawsuit.
