Apple is facing a proposed class action lawsuit accusing it of fraud and false advertising over a security flaw in iCloud Private Relay, according to 9to5Mac.
The suit was filed by the Clarkson Law Firm, which accuses Apple of deceiving iCloud+ subscribers with its marketing of Private Relay, the feature meant to shield a user's IP address and DNS records while browsing in Safari. The firm alleges Apple knew, or should have known, that its privacy claims about the feature were false and misleading at the time it sold the subscriptions.
Clarkson previously took Apple to court over the delayed rollout of personalized Siri features, a case that ended in a $250 million settlement. That deal was reached in December 2025, though the payout terms were not made public until May.
Clarkson partner Tim Giordano said Apple had built its reputation on privacy promises, and argued that iCloud+ subscribers paid a premium for protection that failed to hold up, calling it "an outrageous violation and betrayal of consumer trust and law."
The lawsuit points to a set of WebKit issues that security researchers detailed earlier this month. The most serious ties to passkey sign-ins: a site can trigger a passkey check that gets handled by the device's operating system rather than Safari, bypassing Private Relay's proxy servers entirely, sometimes without showing any passkey prompt at all, even on a site that only claims to support them.
Two further issues, tied to DNS prefetching and the WebTransport protocol added in iOS 26, can also expose a user's real IP address or DNS servers under certain conditions. Since WebKit powers every browser on iOS, the exposure is not limited to Safari.
