Apple’s Hide My Email Faces Lawsuit Over Alleged Privacy Flaw

Apple has built its reputation around a simple promise: personal information should remain personal. A newly filed lawsuit now challenges whether one of the company’s best-known privacy tools delivered that protection.

California resident Anthony Alvarez filed a proposed class action against Apple on July 15, 2026, in the U.S. District Court for the Northern District of California.

The complaint alleges that Apple’s Hide My Email feature contained a vulnerability that could link randomly generated email aliases to users’ actual addresses.

The allegations have not been proven, no class has been certified, and the court has not ruled that Apple violated any law. However, the case raises a significant question for millions of customers: What happens when a privacy feature may not provide the protection its name suggests?

How Apple’s Hide My Email Feature Is Supposed to Work

Hide My Email allows users to create unique, randomly generated email addresses instead of sharing their primary address with websites, apps, and online services.

Messages sent to the alias are forwarded to the user’s real inbox. The website receives the temporary address, while the personal address is supposed to remain private.

Apple provides the feature in two main forms. Sign in with Apple can generate a relay address when someone creates an account on a participating website or app.

Paid iCloud+ subscribers can create additional aliases for newsletters, forms, online purchases, and other services.

Apple’s current support documentation says Hide My Email lets subscribers keep their personal addresses private and avoid sharing their real email when completing forms or registering online.

What the Apple Hide My Email Lawsuit Alleges

The lawsuit claims that a vulnerability allowed a person to start with a Hide My Email alias and uncover the real address behind it without insider access or elevated account privileges.

Security researcher Tyler Murphy reportedly discovered the issue and notified Apple in June 2025. When the vulnerability became public in July 2026, 404 Media said it had independently reproduced the problem using one of its own Hide My Email addresses. The publication withheld the technical steps because it said the issue remained exploitable.

Murphy reportedly said every address examined during limited testing was vulnerable. That does not establish that every Hide My Email account was exposed or that criminals exploited the issue at scale.

It does, however, form a central part of the complaint’s argument that Apple marketed a privacy safeguard that could allegedly be reversed.

The complaint also describes a separate alleged problem involving outgoing messages. It claims that when a user sends an email with an attachment through Hide My Email, the real address could be transmitted and later appear in the recipient’s reply. This accusation is part of the plaintiff’s filing and has not been established by a court.

Lawsuit Claims Apple Knew About the Vulnerability for a Year

The timing may become one of the most important parts of the case. According to the complaint, the researcher gave Apple instructions for reproducing the problem in June 2025. Apple reportedly acknowledged the report approximately one month later and said it was investigating.

In March 2026, Apple allegedly told the researcher that a recent system change had addressed the issue. The researcher reportedly tested the feature again, concluded that the vulnerability remained, and sent additional information to Apple.

The complaint says Apple was still investigating in May and asked that the issue remain confidential to avoid placing customers at risk. Later that month, Apple reportedly said a security update would address the problem within the coming weeks.

The researcher went public on July 1 after concluding that the vulnerability had not been fixed.

Apple separately announced in June that new Sign in with Apple and iCloud+ Hide My Email addresses would move to a shared private.icloud.com domain later in the summer. Existing aliases would continue operating. Apple’s announcement described the change as a domain transition and did not publicly identify it as a fix for the reported vulnerability.

Who Filed the Lawsuit and What Compensation Is Being Sought?

Alvarez says he purchased an iPhone and subscribed to the 200GB iCloud+ plan around March 15, 2025. He claims privacy influenced his decision to purchase Apple products and pay for iCloud+.

His alleged injury is primarily financial. The complaint does not say that an attacker uncovered or misused his personal address. Instead, Alvarez argues that he paid more for Apple products and services because he believed Hide My Email would provide the advertised protection.

He says he would not have purchased the products at the same price, or might not have purchased them at all, had he known the feature could allegedly expose his real address.

The proposed lawsuit seeks to represent four groups:

• U.S. residents who purchased an Apple product and used Hide My Email.
• California residents who purchased an Apple product and used the feature.
• U.S. residents who subscribed to iCloud+ and used Hide My Email.
• California iCloud+ subscribers who used the feature during the relevant period.

The complaint accuses Apple of false advertising, unfair competition, fraud, negligent misrepresentation, breach of contract, breach of implied contract, breach of warranty, and unjust enrichment.

It seeks class certification, damages, restitution, legal fees, and an order requiring Apple to fix the feature or clearly disclose its limitations.

Were Apple Users’ Real Email Addresses Actually Stolen?

There are currently no publicly confirmed cases of attackers using the reported vulnerability to target Hide My Email customers.

The lawsuit is therefore not primarily built around documented identity theft, account takeovers, or widespread spam campaigns. It focuses on whether consumers paid for products and subscriptions based on allegedly misleading privacy representations.

That distinction matters. Demonstrating that a vulnerability existed is different from proving that criminals exploited it. It is also different from proving that Apple knowingly deceived consumers.

Those questions will have to be tested through evidence, legal arguments, and potentially expert testimony if the case moves forward.

What Hide My Email Users Should Do

We should not assume that every alias has been exposed. Users can still reduce unnecessary risk by promptly installing Apple security updates, reviewing which aliases are linked to important accounts, and monitoring for unexpected password reset messages or suspicious emails.

Anyone using an alias for highly sensitive communications should avoid treating it as a complete anonymity system.

An email alias can reduce routine exposure, spam and cross-site tracking, but it should work alongside strong passwords, two-factor authentication and careful account-recovery settings.

Users should also avoid deleting aliases associated with active accounts without first updating the email address on the website. Removing an alias prematurely could make account recovery more difficult.

Why the Hide My Email Case Matters for Apple

This lawsuit reaches beyond a single software feature. Apple has repeatedly positioned privacy as a defining difference between its products and competing platforms.

The plaintiff’s argument is that privacy was not merely an extra benefit. It was part of the product being sold.

Apple may challenge whether the alleged flaw affected all users, whether Alvarez suffered a legally recognizable injury, and whether broad groups of hardware buyers can claim they paid a privacy-related premium.

The company could also dispute the technical allegations, the proposed class definitions, or the suggestion that its marketing created an enforceable guarantee.

For now, Alvarez v. Apple Inc. remains an early-stage proposed class action. There is no settlement, no approved claim form, and no finding that Apple is liable.

Yet the dispute places one of Apple’s most valuable promises under direct scrutiny: when customers pay for privacy, the protection must be more than a reassuring name.