A proposed class action lawsuit filed in California accuses Apple of misleading customers about the privacy protections of its Hide My Email feature. The complaint, lodged in federal court, alleges that Apple has known for over a year about a security flaw that could expose the real email addresses behind Hide My Email aliases, yet failed to fix it. Plaintiff Anthony Alvarez seeks to compel Apple to either repair the feature or clearly disclose its limitations, along with financial compensation.
Hide My Email allows users to create unique, randomly generated email addresses that forward messages to their personal inbox, enabling sign-ups for apps, websites, and newsletters without sharing their real address. The feature is available for free through Sign in with Apple, while a more robust version is included with iCloud+ plans starting at $0.99 per month. The lawsuit claims Apple continued to profit from Hide My Email and its privacy promises despite the alleged vulnerability.
Sponsored Protocol
Flaw reported in June 2025
According to a report by 404 Media, a security researcher alerted Apple in June 2025 to a flaw that could reveal real email addresses behind Hide My Email aliases. Apple acknowledged the report about a month later but allegedly left the issue unresolved. In March 2026, the company said it had addressed the flaw, but the researcher found the vulnerability remained exploitable. At the end of May, Apple stated it planned to address the issue in a future security update expected in the coming weeks. The researcher then contacted 404 Media, saying: We don't know why it hasn't been fixed, but we don't feel comfortable waiting any longer.
Sponsored Protocol
Class action allegations
The lawsuit alleges that Apple has known of the problem for over a year and the flaw remains unfixed to this day, while Apple continues to profit from Hide My Email and its privacy promises. Alvarez claims he is one of millions of customers who paid for iCloud+ and relied on Apple's representations that Hide My Email would keep his personal email address hidden. The complaint also points to a 2023 report that found Apple's randomized MAC address feature could expose users' real hardware identifiers, suggesting a pattern of privacy issues.
Sponsored Protocol
This is not the first legal challenge for Apple: recently, the company released iOS 27 public betas and sued OpenAI over trade secrets theft. For additional context on iCloud and its privacy features, you can refer to the Wikipedia page on iCloud.
The lawsuit seeks class certification covering four proposed groups of users. Alvarez demands a jury trial and, in addition to an undetermined amount of financial compensation, asks the court to require Apple to either fix Hide My Email or clearly disclose its limitations. Apple has not yet commented on the lawsuit.
