In California, a lawsuit was filed against Apple Inc. regarding a significant flaw in its Hide My Email feature, which is part of the iCloud service. This feature is designed to provide users with temporary, anonymized email addresses to protect their privacy when signing up for various online services. However, a security vulnerability was discovered that allows anyone to uncover users' real email addresses linked to these temporary aliases. The lawsuit, known as Alvarez v. Apple Inc., claims that Apple engaged in false advertising and fraud by promoting a privacy tool that it allegedly failed to secure adequately.
The issue was brought to Apple's attention by a security researcher in June 2025, yet the company reportedly did not address the flaw while continuing to market the feature as a secure option for users. The lawsuit seeks class action status and requests a jury trial, with claims exceeding $5 million. It also demands that Apple either rectify the vulnerability or disclose the limitations of the Hide My Email feature to users.
Research conducted by Easy Opt Outs and reported by 404 Media revealed that basic online identity search tools could exploit the flaw, exposing 100% of the tested Hide My Email addresses. This vulnerability poses a significant risk, as malicious actors could use the real email addresses to access sensitive personal information through public records or data leaks. The implications of this flaw are severe, as it undermines the privacy that users expect from Apple's services.
In response to the ongoing concerns, Apple is planning to update the Hide My Email feature later in the summer of 2026. The changes will involve switching the email addresses from the current "iCloud.com" domain to a new "private.iCloud.com" domain. This modification may inadvertently make it easier for websites to filter out these new addresses, potentially forcing users to either provide their real email addresses or resort to third-party temporary email services. As the lawsuit progresses, users who have utilized the Hide My Email feature and are concerned about their privacy may need to remain patient, as the legal process can be lengthy and complex.
