(José Niño, Headline USA) Apple has spent years selling itself as the privacy company, but a fresh lawsuit contends that one of its flagship privacy tools was essentially a vault with the door hanging loose. As Reclaim the Net tells it, a customer in California claims Apple went on charging for protection that was never truly in place.
This week Anthony Alvarez brought a proposed class action against the company, claiming it pocketed money for privacy it was never able to deliver. His filing arrives on the heels of reporting by Reclaim the Net showing that almost anybody can uncover the actual inbox sitting behind a Hide My Email alias, all because of a bug Apple has allowed to linger for over a year.
The tool is meant to serve as a barrier. Someone creates a random alias, passes it to an app or a newsletter, and Apple silently relays the incoming mail to the person’s real account while keeping it out of view. People who sign in with Apple get the stripped down version for free, while iCloud+ subscribers paying as little as $0.99 a month can mint aliases for whatever sites they like. In sum, the selling point is anonymity one can lease.
That guarantee came apart once Tyler Murphy, who co-founded EasyOptOuts, figured out how to follow an alias back to its true address and handed Apple the whole thing, replication steps and all, in June 2025. As Reclaim the Net points out, 404 Media verified the flaw using one of its own aliases and found that every Hide My Email address it examined could be traced to the genuine owner. The publication is keeping the technical specifics under wraps because the gap is still open.
After roughly a year of waiting on a fix that never showed up, Murphy chose to speak out. “Apple Hide My Email is leaking email addresses that are supposed to be hidden. We reported the issue and replication instructions to Apple over a year ago. We don’t know why it hasn’t been fixed, but we don’t feel comfortable waiting any longer. Hide My Email users deserve to know that it may be possible for attackers to discover their hidden email addresses,” he said.
Apple acknowledged his report a month after it landed. By March 2026, it told Murphy it had “addressed the reported issue in a recent system change,” yet the flaw kept working. Toward the end of May, the company claimed a fix was “expected in the coming weeks.” Murphy pressed Apple to halt the minting of new aliases until it could genuinely protect them, and the company gave no sign it would.
Murphy has been pointed about who bears the most risk from a leak. “Free, publicly accessible people-search sites make it easy to link an email address to other personal details, so people relying on Hide My Email for safety may be at risk,” he said. The people who lean hardest on a throwaway alias, those trying to stay ahead of a stalker or an abuser, are exactly the ones a leak harms soonest.
Alvarez converts that hazard into a bill. “Apple has known of the problem for over a year, and the flaw remains unfixed to this day—all while Apple continues to profit from Hide My Email and from its promises of privacy,” the complaint reads. He casts himself as “one of the millions of customers who paid Apple for iCloud+ and relied on Apple’s representations that Hide My Email would keep his personal email address hidden.”
The complaint contends that customers paid for privacy on two fronts. “Plaintiff and Class Members paid Apple for their privacy—iCloud+ subscribers though the price-premium built into iCloud+ subscription fees, and all Apple customers through the price premium built into Apple products that Apple markets as including enhanced privacy protections and features such as Hide My Email,” the filing states.
As Reclaim the Net lays out, the complaint stacks nine causes of action, among them breaches of California’s Unfair Competition Law, False Advertising Law, and Consumers Legal Remedies Act, together with fraud, negligent misrepresentation, breach of contract, breach of implied contract, breach of implied warranty of merchantability, and unjust enrichment.
Alvarez is seeking damages, restitution, a jury trial, and “injunctive relief to ensure Apple ceases its deceptive conduct and either delivers the privacy protection it promised or clearly discloses that it cannot.” He is asking the court to certify four classes covering Apple device owners and iCloud+ subscribers, both nationwide and within California, with the combined claims pegged above $5 million.
José Niño is the deputy editor of Headline USA. Follow him at x.com/JoseAlNino
