iCloud Private Relay

iCloud Private Relay

Developer	Apple
Type	Internet privacy service
Launched	September 20, 2021 (2021-09-20) (public beta)
Operating systems	iOS, iPadOS, macOS, visionOS
Pricing model	Included with iCloud+
Website	support.apple.com/en-us/102602

iCloud Private Relay is an internet privacy service offered by Apple as part of an iCloud+ subscription. It protects web browsing in Safari, DNS resolution, and unencrypted HTTP app traffic by routing communications through two separate relays. The first relay can see the user's IP address but not the destination, while the second relay handles the destination without knowing the user's original IP address.

Private Relay was announced in June 2021 and became available as a public beta that September. An Apple privacy notice dated December 2025 states that the service is available on iOS, iPadOS, visionOS, and macOS. Its network architecture, performance, and resistance to traffic-correlation analysis have been subjects of academic research. A problem that could expose a user's real IP address through Safari's WebRTC implementation was reported in 2021, and in 2026 researchers reported that several WebKit features could bypass Private Relay and expose DNS information or a user's real IP address. At the time of the 2021 report, the problem had been fixed in a macOS beta but remained unfixed on iOS. The issues reported in 2026 were subsequently fixed in operating-system updates. Private Relay can also be incompatible with systems used by businesses, schools, and telecommunications providers to audit or filter network traffic, and European telecommunications operators have raised concerns about its effects on network management and competition.

History

Apple announced iCloud Private Relay at the Worldwide Developers Conference in June 2021 as a new internet privacy service included with iCloud+. It became available as a public beta with the release of iOS 15 on September 20, 2021. At launch, its use required iOS 15 on an iPhone, iPadOS 15 on an iPad, or macOS Monterey or later on a Mac. Apple's privacy notice dated December 2025 lists iOS, iPadOS, visionOS, and macOS as supported operating systems.

According to Reuters, Apple said on the day Private Relay was announced that the service would not be offered in China and nine other countries for regulatory reasons. Apple also states in its support documentation that Private Relay is not available in all countries or regions.

Architecture

Two-hop relay

iCloud Private Relay divides communications between two independent internet relays. Traffic from the user's device first enters a relay known as the ingress proxy, which is operated by Apple. The ingress proxy can see the user's IP address, but information about the destination is encrypted, preventing it from determining which website the user is attempting to visit. Traffic then passes through an outbound relay known as the egress proxy, which is operated by a provider other than Apple. The egress proxy assigns a temporary IP address and forwards the traffic to its destination. It handles the destination while remaining unaware of the user's original IP address. This separation is intended to prevent any single entity from simultaneously knowing both the user's IP address and the websites the user visits.

When the service was introduced, Apple said only that its egress partners were major content delivery network providers and did not identify them by name. Researchers measuring the service in 2023 identified egress proxies operated by Akamai, Cloudflare, and Fastly.

According to Apple's developer documentation, connections to the relays use QUIC, a standard transport protocol based on UDP, with connections established over port 443 using TLS 1.3. The user's IP address is replaced with a relay IP address; depending on the user's settings, this can preserve a general location or be limited to information corresponding to the user's country and time zone.

Private Relay uses the Internet Engineering Task Force's MASQUE technology to proxy connections. CONNECT and CONNECT-UDP over HTTP/3 allow multiple TCP and UDP communications to be multiplexed over a single QUIC connection. On networks where QUIC cannot be used, the system falls back to a method using HTTP/2 and TLS 1.3. DNS resolution uses Oblivious DNS over HTTPS (ODoH). DNS queries are padded and encrypted using Hybrid Public Key Encryption (HPKE) before being sent through the first relay to a DNS resolver.

Traffic coverage and differences from VPNs

Apple states that Private Relay protects Safari web browsing, DNS resolution, and unencrypted HTTP app traffic. Its traffic coverage and handling of location therefore differ from those of a typical VPN. Wired and Macworld have noted that Private Relay does not allow users to select an arbitrary country's IP address in order to appear to be connecting from that country, and is not a complete replacement for a VPN.

Research and evaluation

In 2022, researchers at the Technical University of Munich measured Private Relay's network architecture for the ACM Internet Measurement Conference. They identified 1,586 IPv4 ingress addresses and 1,575 IPv6 ingress addresses. Using RIPE Atlas, a globally distributed network of measurement probes, to perform DNS resolution, they found that, according to the paper's abstract, 5.3% of the measurements used a DNS resolver that blocked access to Private Relay. The researchers also found that ingress relays, which Apple describes as Apple-operated, were located not only in Apple's networks but also in an autonomous system managed by Akamai, with ingress and egress relays located in the same autonomous system. They noted that when both relay stages are located within the same network, their routes can be similar, potentially allowing traffic-correlation analysis by comparing ingress and egress traffic.

In 2023, researchers from the University of Trieste and other institutions measured Private Relay's performance for the Passive and Active Measurement conference. They reported that, under some test conditions, download throughput measured by speed tests fell by as much as a factor of ten and that web-page loading was also delayed. Traffic routed through Private Relay, however, can follow paths different from ordinary internet routing, and the researchers found that this overlay routing could in some cases improve performance relative to the ordinary route.

A preprint published the same year compared location estimates from several commercial IP geolocation services with the location information Apple publishes for Private Relay egress IP addresses. Accuracy varied substantially by country, IP-address version, relay operator, and measurement period. For IP2Location, the researchers reported that the median location error for IPv4 addresses exceeded 1,000 miles (about 1,600 kilometers) in some countries.

Also in 2023, researchers at the University of Massachusetts Amherst evaluated Private Relay against two representative types of traffic-analysis attacks at the ACM Asia Conference on Computer and Communications Security. The first was a flow-correlation attack, in which an attacker able to observe both ingress and egress traffic matches characteristics such as packet timing and size to associate the two flows and identify a user. The second was website fingerprinting, in which characteristics such as packet timing and size in encrypted traffic are compared with known website traffic traces to infer which website a user is visiting. The authors simulated internet routes and estimated that, for 36.8% of Private Relay connections, the same autonomous system appeared on both the ingress-side and egress-side paths. For those connections, that autonomous system would be in a position to perform a flow-correlation attack. Many of the connections identified as vulnerable traversed autonomous systems operated by Akamai. The researchers also reported high success rates for both types of attack in their experimental environment.

In 2025, researchers at the Hasso Plattner Institute of the University of Potsdam compared the client implementations of iCloud Private Relay, Google's IP Protection, and Microsoft Edge's Secure Network VPN. The authors reported finding multiple issues in all three services that arose from their architectures and weakened their privacy or security guarantees.

IP address and DNS leaks

Shortly after Private Relay became available, a problem was reported in September 2021 that could expose a user's real IP address through Safari's handling of WebRTC, a system used for direct audio and video communication between browsers. Some traffic sent while WebRTC establishes a connection did not pass through Private Relay, allowing a website to obtain the user's real IP address. According to The Hacker News, FingerprintJS, which discovered the problem, reported it to Apple. A fix had been released in the then-current beta of macOS Monterey, while the issue remained unfixed in iOS 15 at the time of the report.

In August 2026, security researchers disclosed that three WebKit features—DNS prefetching, WebAuthn Related Origin Requests, and WebTransport—could communicate directly from a device without using its configured proxy. According to the researchers, DNS prefetching could perform resolution through the device's normal DNS path, potentially revealing the DNS resolver ordinarily used by the device. With Related Origin Requests, the operating system's credential service could directly retrieve a verification file, while WebTransport could establish an HTTP/3 connection directly rather than through the proxy; in either case, the destination could in some circumstances observe the device's real IP address. TechCrunch reproduced the behavior using a proof-of-concept website published by the researchers, displaying the real IP address while Private Relay was enabled.

The researchers later reported that they could no longer reproduce the Private Relay bypasses through these features in the public releases of iOS 26.6.1 and macOS Tahoe 26.6.2. The Hacker News also stated in an August 25 update that the reported issues had been fixed in the public releases of iOS 26.6.1 and macOS Tahoe 26.6.2. In security information published in September, Apple disclosed that the WebKit information-disclosure vulnerability CVE-2026-65352, which could allow a website to determine a user's IP address while Private Relay was enabled, had been addressed in iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. Apple credited the researchers who had disclosed the issue in the CVE entry.

Relationship with network operations

Private Relay can conflict with systems that rely on information about destinations or IP addresses at the network level. Apple states that networks operated by businesses or schools can block access to Private Relay when their policies require network traffic to be audited. Some websites may also require additional steps or become inaccessible while Private Relay is in use if they rely on IP-based filtering, monitoring, or rate limiting.

In August 2021, four European telecommunications operators argued in a letter to European lawmakers that Private Relay would reduce access to network metadata and affect network management and competition. A security expert interviewed by Wired, however, said there was little evidence supporting the problems claimed by the telecommunications operators. In the United States, cases were also reported in which some T-Mobile content-filtering features were incompatible with Private Relay.