Apple Faces Class-Action Lawsuit Over “Hide My Email” Privacy Claims

A California lawsuit, *Alvarez v. Apple Inc.*, alleges that Apple misled users about the privacy guarantees of its Hide My Email feature. The complaint, filed by iCloud+ subscriber Anthony Alvarez, accuses Apple of false advertising, fraud and breach of contract for selling a privacy tool that may expose users’ real email addresses. The plaintiff seeks class-action certification for four groups: nationwide Apple customers who used Hide My Email, a California subclass of those users, nationwide iCloud+ subscribers who used the feature, and a California subclass of iCloud+ subscribers. The suit requests a jury trial, monetary damages exceeding $5 million, and an order requiring Apple either to fix the vulnerability or to disclose its limitations. Apple has not commented.

9to5MacCNET

Hide My Email, available for free via Sign in with Apple and as part of paid iCloud+ plans, generates random iCloud.com aliases that forward to a user’s personal inbox. In June 2025, a security researcher alerted Apple to a flaw that could reveal the underlying real email address. Apple acknowledged the report a month later but, according to the plaintiff, left the issue unresolved. Apple announced in March 2026 that it had addressed the flaw, yet the researcher reported the vulnerability remained exploitable. 404 Media later noted that “100% of the Hide My Email addresses on the two websites tested were exploitable,” highlighting the risk that malicious actors could link aliases to users’ names, addresses, phone numbers and other sensitive data.

9to5MacCNET

Apple has not provided a public response to the filing. The complaint notes that Apple continues to market Hide My Email as a privacy-enhancing feature despite the alleged unresolved flaw. The lawsuit also references Apple’s plan to modify the service later in the summer, switching alias domains from “iCloud.com” to “private.iCloud.com,” a change that could affect how websites handle the aliases.

9to5Mac

The plaintiff argues that Apple profited from Hide My Email while knowingly exposing users’ personal information. Alvarez contends that the company’s representations “misled… millions of customers who paid for iCloud+ and relied on Apple’s promises that Hide My Email would keep his personal email address hidden.” The suit also cites a 2023 report on Apple’s randomized MAC address feature, suggesting a pattern of privacy-related shortcomings.

9to5MacCNET

• “We don’t know why it hasn’t been fixed, but we don’t feel comfortable waiting any longer.” — Murphy, security researcher

9to5Mac

• “ Back to the lawsuit (via MacRumors), the plaintiff, Anthony Alvarez, says: Apple has known of the problem for over a year, and the flaw remains unfixed to this day—all while Apple continues to profit from Hide My Email and from its promises of privacy.” — Anthony Alvarez, plaintiff

9to5Mac

• “The suit, which seeks class action status, requests a jury trial and states that the value of the claims is greater than $5 million.” — *Alvarez v. Apple Inc.* filing

CNET

• “404 Media reported that 100% of the Hide My Email addresses on the two websites tested were exploitable.” — 404 Media report

CNET

The court must first determine whether the proposed groups meet the requirements for class certification, a process that could take months before any users can join the action.

CNET