Apple is being sued in a class action over a supposed security issue with "Hide My Email."

Apple Faces Class Action Over “Hide My Email” Feature

Apple is currently entangled in a class action lawsuit that claims its “Hide My Email” feature doesn’t effectively conceal users’ actual email addresses from websites and applications. The lawsuit was filed on Wednesday in federal court.

The complaint asserts that Apple was aware the feature, which debuted in 2019, was not functioning properly as early as last summer but has failed to take adequate measures to resolve the issue. Despite Apple’s assurances that the feature generates a “unique, random email address” forwarded to users’ real inboxes, the problem remains unsolved.

“A vulnerability in Hide My Email’s implementation allows virtually anyone without elevated privileges or insider access to link a Hide My Email alias to a user’s actual email address. Independent testing found that 100% of the aliases examined were exploitable,” the complaint details.

Apple provides the “Hide My Email” service in two ways: through “Sign in with Apple,” allowing users to mask their email addresses when creating accounts online, and through a paid iCloud+ subscription that permits users to generate private relay addresses for broader use.

Anthony Alvarez, a resident of San Diego, has filed the lawsuit. He claims to be “one of the millions of customers” who subscribed to iCloud+ believing that their email information would be kept safe. This feature is supposed to protect users from spam, prevent their data from being sold to brokers, and safeguard their information from breaches.

According to the lawsuit, security researchers identified the flaw in the feature back in June 2025 and alerted Apple. A month later, Apple acknowledged the problem and indicated that it had “addressed the reported issues with recent system changes.” However, further reports indicated that the bug still existed, leading Apple to promising a patch by May, which never materialized. Consequently, researchers publicized the Hide My Email vulnerability.

If the court determines that many people were impacted by this security flaw, the case could advance as a class action. While the lawsuit does not specify a particular amount in damages, it does seek restitution for customers who paid for privacy protections that did not function as advertised.