SerpApi.Org
Apple is being sued over a reported bug in its Hide My Email feature.
The class-action lawsuit, filed in California’s Northern District on July 15, highlights Apple’s goal to position itself as a privacy-first company, describing the ‘Hide My Email’ feature as a “pillar” of its privacy marketing.
However, the issue—which the suit does not disclose, due to security concerns—would allow bad actors to see email addresses that Apple advertises as hidden.
According to the suit, Apple was informed of the issue in June 2025, and while the company acknowledged the report, no action was taken for more than a year.
The suit adds that during that time, Apple continued to advertise Hide My Email, claiming the problem was fixed in March 2026.
However, researchers had warned Apple the problem was not fixed.
“Apple’s response to being told its purported fix had failed was to ask security researchers, once more, to keep silent,” the suit says.
What is ‘Hide My Email’?
Hide My Email is included with Apple’s iCloud+ subscription and allows users to generate random email aliases instead of sharing their personal address when signing up for websites, apps or newsletters.
Messages sent to the alias are automatically forwarded to the user’s primary inbox, helping reduce spam and limit the amount of personal information shared online.
Tech outlet 404 Media spoke to the researcher who discovered the vulnerability.
‘Don’t feel comfortable’
Tyler Murphy, co-founder of privacy service EasyOptOuts, told the outlet that Apple has been aware of the issue for more than a year.
404 Media said it had independently verified the issue using one of the company’s own Hide My Email addresses, as well as Murphy’s correspondence with Apple.
Murphy told the outlet that he isn’t sure why the problem remains ongoing, but “we don’t feel comfortable waiting any longer.”
‘More peace of mind’
The suit notes that Hide My Email specifically advertises that it will “keep your personal email address private” under the banner, “More privacy. More protection. More peace of mind.”
“A vulnerability in the implementation of Hide My Email allows almost anyone, without elevated privileges or insider access, to link a Hide My Email alias back to the user’s real email address,” the suit says.
“Independent testing found that 100% of the aliases examined were exploitable.”
‘A pattern’
The suit calls the issue “a pattern,” noting that in 2023, researchers found that a feature that was supposed to anonymize Wi-Fi connections was, “in practice, exposing the real identifier.”
“Apple deceived millions of consumers into paying for a premium privacy feature that did not do the one thing Apple promised it would do, in violation of false advertising and consumer protection laws,” the suit says.
Newsweek previously covered a lawsuit that alleged that Apple overstated the capabilities of its AI technology, in which iPhone users were awarded $250 million.
Newsweek has reached out to Apple for comment via email.
Related Articles
