Privacy Flaw in Apple’s Hide My Email Feature Sparks Lawsuit

A class action lawsuit has been initiated against Apple regarding a potential flaw in the “Hide My Email” feature, which could potentially expose a user’s actual email address. The lawsuit alleges that Apple violated California’s false advertising law by offering a feature that does not function as advertised.

Researchers discovered the flaw in early June, confirming its existence and the ability to exploit it. Despite no known instances of the flaw being exploited, the vulnerability has not been disclosed to prevent misuse.

The security flaw was reported to Apple over a year ago, but a fix has yet to be implemented. The lawsuit, filed by Anthony Alvarez, accuses Apple of false advertising, fraud, breach of contract, and other violations related to the marketing of Hide My Email.

The lawsuit seeks damages and a mandate for Apple to rectify the flaw or disclose its limitations. It covers both the paid iCloud+ plans and the more limited relay addresses generated through Sign in with Apple.

The lawsuit is based on the fact that Apple sold a privacy feature it could not deliver. While the allegations have not been tested in court, Alvarez seeks to represent four proposed classes of US Apple customers.

The flaw was reported to Apple in 2025, but it was only made public in July 2026 after Apple failed to address it. Despite Apple’s claim of fixing the issue, further testing revealed that the vulnerability was still exploitable.

While the lawsuit raises valid concerns about Apple’s handling of the issue, no actual attacks have been reported. Alvarez’s claim is based on financial damages, alleging that he would not have subscribed to iCloud+ if he had known about the security flaw.

The lawsuit targets buyers of new Apple hardware who used the Hide My Email feature. While the iCloud+ charges may be warranted, the hardware complaint raises questions about separating the value of the feature from the device.

Overall, the lawsuit appears to be more focused on financial gains rather than compensating consumers who were directly affected by the vulnerability. While privacy flaws should be addressed promptly, the lawsuit’s motives may be questioned.