New Lawsuit Filed Against Apple for 'Hide My Email' Privacy Vulnerability

Apple's Hide My Email feature, marketed as a privacy shield, has a flaw that can expose users' real email addresses to anyone who knows where to look. A new lawsuit alleges that the vulnerability undermines the very promise of the service and puts millions of iCloud users at risk.

A class action lawsuit filed against Apple in the U.S. District Court for the Northern District of California on March 10, 2025, claims that the company's Hide My Email feature contains a fundamental privacy flaw. The suit argues that Apple misled consumers by advertising the tool as a way to keep their personal email addresses secret, when in fact the feature leaks real addresses through a simple online lookup. The case highlights growing tensions between Apple's privacy marketing and the actual security of its cloud services.

Hide My Email, introduced with iOS 15 in 2021, lets users generate unique, random email addresses that forward to their real iCloud email. The feature is a cornerstone of Apple's broader privacy narrative, especially with iCloud+ subscribers who pay for enhanced protections. However, security researchers discovered that the system's forwarding mechanism can be manipulated: by querying Apple's servers in a specific way, anyone can reveal the real destination email address behind a forwarding alias. Apple has not yet patched the issue, despite being notified months ago.

The lawsuit, brought by lead plaintiff Sarah Jenkins on behalf of affected iCloud+ users, seeks unspecified damages and an injunction requiring Apple to fix the vulnerability. It names Apple Inc. as the sole defendant and cites breaches of California consumer protection laws. The plaintiffs' lawyers argue that Apple's failure to disclose the flaw violates its own privacy promises and state law. Apple has not commented publicly on the litigation, but the case is likely to attract attention from regulators and privacy advocates.

This is not the first time Apple's privacy features have faced scrutiny. In 2022, a similar flaw was found in iCloud Private Relay, and the company has been hit with multiple lawsuits over Siri recordings and location tracking. The Hide My Email case, however, strikes at the core of Apple's value proposition: selling devices that protect user data. If the court finds that Apple knew about the weakness and did nothing, it could damage consumer trust and invite more aggressive oversight from the Federal Trade Commission.

The immediate next step is a status conference scheduled for May 2025, where Apple will likely file a motion to dismiss. Privacy watchers will also be watching for any emergency patches or security advisories from Apple. For now, users who rely on Hide My Email should reconsider trusting it with sensitive accounts—at least until Apple proves it can keep their real addresses truly hidden.