Overview
- The Clarkson Law Firm filed a proposed class-action on Tuesday accusing Apple of false advertising, misrepresentation, and fraud by selling iCloud+ subscriptions that promised IP and DNS protection.
- Researchers published a proof of concept showing that WebAuthn passkey validation, DNS prefetching, and WebTransport can cause the device or OS to make network requests outside the Private Relay proxy path, which can expose a user’s real IP address to websites.
- Because Apple requires all iOS browsers to use the WebKit engine, the reported leaks can affect Safari and third-party browsers on iPhone and broaden the scope of exposed users.
- Security researchers and some third-party browser makers have rolled out mitigations and guidance, and Apple is reported to be investigating with a fix targeted for fall 2026 while the company has not publicly commented on the lawsuit.
- The case raises potential consumer remedies and legal risk for Apple given Clarkson’s recent $250 million settlement with the company, and users who want immediate IP hiding are advised to use a system-level VPN or disable the features the researchers flagged.