Apple Sued Over Flawed 'Hide My Email' Privacy

A lawsuit, Alvarez v. Apple Inc., has been filed in California, alleging that Apple engaged in false advertising, fraud, and breach of contract by selling a privacy feature that allegedly does not work as advertised. The core of the complaint centers on Apple's Hide My Email tool, a component of the paid iCloud Plus subscription.

This feature generates temporary, anonymized email addresses for users, intended to shield their real email from new websites and subscriptions. However, the lawsuit claims a persistent security vulnerability allows basic online tools to uncover the true email addresses behind these aliases. This flaw was reportedly disclosed to Apple in June 2025 but remained unaddressed.

The suit seeks class action status and is requesting a jury trial, with claims exceeding $5 million. It demands that Apple rectify the vulnerability or provide full disclosure of its limitations. Reports indicate that 100% of tested Hide My Email addresses were exploitable, posing a significant risk.

If a malicious actor obtains a user's real email, they could access public databases to find personal information or exploit data breach lists. Apple is also planning to update the tool later this summer, changing the domain from 'iCloud.com' to 'private.iCloud.com,' which might enable websites to filter these addresses.