If you use iCloud Private Relay, Apple’s paid IP address masking service, your internet browsing activity may not actually be private. As 404 Media reports, flaws in Apple’s web browser engine allow IP addresses to be revealed, either maliciously or incidentally, even when they’re supposed to be hidden.

How Private Relay is exposing IP addresses

iCloud Private Relay, which is part of Apple’s iCloud+ subscription, is supposed to keep both who you are and what sites you visit hidden when you are browsing in Safari. Without it, your network provider and the websites you view can see your IP address and DNS records, which can be used to track your location and browsing history over time. Private Relay is supposed to encrypt DNS records and generate a temporary IP address, keeping any single party, including Apple, from obtaining both.

The issue, discovered by security researchers Talal Haj Bakry and Tommy Mysk, is related to how passkeys work. Web requests are made outside of the browser and the protections of Private Relay, meaning that websites that support passkeys can see users’ real IP addresses. Obviously, this impacts Safari traffic, but researchers found the issue in Onion Browser, an iOS app that encrypts traffic through the Tor network. Both 404 Media and TechCrunch verified the issue in their own tests.

The researchers stated that they informed Apple but haven’t been given a timeline for when the vulnerability will be addressed. Apple is generally pretty good on privacy issues, but this isn’t the first to arise in recent months. In July, “Hide My Email,” the company’s email masking service, was revealed to have a vulnerability that actually exposed users’ real email addresses. Apple reportedly knew about it for over a year and claimed to have patched it—but it hadn’t.

While Private Relay can be a useful privacy tool—if it works as intended—it’s not a true VPN (Virtual Private Network) because it only provides protection when browsing in Safari. If you want to keep your IP address hidden and your data encrypted across all apps and browsers on your device, you may want to consider a separate VPN service.