A California Apple user has filed a class action lawsuit, accusing the company of misleading customers about the privacy of the Hide My Email feature. According to 404 Media, Apple knew about a security bug that could reveal users' real email addresses for more than a year but did not fix it.
The Core Issue
The Hide My Email feature allows users to create unique, randomly generated email addresses that forward messages to their personal inbox. This feature is available for free through Sign in with Apple and in an expanded version as part of an iCloud+ subscription (starting at $0.99 per month).
A security researcher notified Apple of a bug in June 2025 that could reveal the real email address behind an alias. Apple confirmed receipt but did not resolve the issue. In March 2026, the company claimed to have fixed the bug, but the researcher found the vulnerability still exploitable.
The Lawsuit's Basis
Plaintiff Anthony Alvarez alleges that Apple knew about the problem for over a year, the bug remains unfixed, and Apple continues to profit from Hide My Email and its privacy promises. Alvarez seeks to have the case certified as a class action for four proposed user groups:
- A nationwide class of Apple customers who purchased devices and used Hide My Email;
- A California subclass of these users;
- A nationwide subclass of iCloud+ subscribers who used the feature;
- A California subclass of iCloud+ subscribers.
Alvarez requests a jury trial and, in addition to financial compensation, asks the court to order Apple to either fix Hide My Email or clearly disclose its limitations. The class claims exceed $5 million, excluding interest and legal costs.
Apple has not yet commented on the lawsuit.