Apple is facing a proposed class action lawsuit over a flaw in its Hide My Email privacy feature that can expose a user’s actual email address, despite the company marketing the tool as a reliable way to keep that information hidden.
Hide My Email is part of iCloud+, Apple’s paid subscription tier that starts at $0.99 per month.
The feature generates random, disposable email addresses that forward messages to a user’s real inbox, letting people sign up for websites and services without surrendering their personal address. The lawsuit alleges that a vulnerability in this system can undo that protection entirely.
Apple Knew for Over a Year
A security researcher privately reported the vulnerability to Apple in June 2025. The lawsuit, filed in California, claims Apple continued advertising Hide My Email as a working privacy tool even after being informed of the flaw.
The specific steps required to exploit the vulnerability have not been made public, and there are no confirmed cases of it being used against real users.
The complaint accuses Apple of violating California’s false advertising law, along with several consumer protection statutes.
At the center of the case is whether Apple knowingly sold a feature it understood to be broken, and whether subscribers paid for privacy they were not actually receiving.
What iCloud+ Subscribers Should Know
Anyone currently using Hide My Email to protect their address when registering for apps, newsletters, or online accounts may be doing so under the assumption that their real email is shielded.
According to the lawsuit, that assumption may not hold. Apple has not publicly confirmed whether a fix has been deployed.
The case puts pressure on a privacy promise Apple has used in marketing for years. The company has built much of its consumer identity around the idea that its hardware and software protect user data in ways competitors do not.
A paid feature failing at its core function while the company remains aware of the issue is the specific conduct the plaintiffs are asking a court to scrutinize.
The lawsuit seeks class action status, which would extend any potential remedy to all affected iCloud+ subscribers, not just the named plaintiffs. No trial date has been set.
