Apple’s iCloud Private Relay has returned to fully private status after a fix in iOS 26.6.1 addressed a vulnerability that could expose a person’s IP address even when the feature was enabled. The patch restores the intended protection for the paid privacy tool, which is available only to those with an iCloud Plus subscription.
iCloud Private Relay routes web traffic through proxy servers to mask a user’s physical location and browsing activity. The feature is specific to Apple’s Safari web browser and apps that rely on Apple’s WebKit framework, and it is not the same as a VPN, which hides all internet traffic across a device.
How the IP Address Leak Was Discovered
Earlier in August, developers Talal Haj Bakry and Tommy Mysk observed that Apple devices with iCloud Private Relay enabled could still leak their IP addresses in three separate circumstances. The developers created a web page where users could check whether their device was affected.
According to Mysk, the fix appeared in Apple’s iOS 26.2.1 release, alongside the 26.2.1 updates for Apple’s other operating systems, even though the change was not noted in Apple’s security release notes. Following the update, the leak checker now reports the masked IP address rather than the device’s actual address. Users must have iCloud Private Relay switched on in Settings, under iCloud, for the protection to apply.
Mysk added that the issue was fixed only for Safari, and suggested the resolution came unusually quickly. An Apple representative did not immediately respond to a request for comment.
Legal Action Over the Vulnerability
Soon after the flaw was revealed, the iCloud Private Relay vulnerability prompted a lawsuit by Clarkson Law Firm. The same firm previously negotiated a EUR 159 million settlement (roughly £200 million) with Apple over how the company advertised its Apple Intelligence features at launch. The firm has also recently sued smart ring maker Oura.
A Clarkson Law Firm representative did not immediately respond to a request for comment. The fix means that, when tested against the leak checker, none of the possible IP leaks reveal a device’s actual IP address when iCloud Private Relay is active.
