Mobile Networking · Network Privacy · Lesson 3 of 4

iCloud Private Relay

See how Private Relay splits your browsing across two companies, and where it stops.

Two Hops, Two Companies

iCloud Private Relay is an Apple feature that arrived with iOS 15 in 2021. It's designed so that no single company, Apple included, sees both who you are and which sites you visit.

It does that with two hops.

• The first relay is run by Apple. It sees your real IP address, so it knows roughly who and where you are. The name of the site you want is encrypted, so this relay can't read it.
• The second relay is run by a separate partner company. It decrypts the site name and connects you using a temporary IP address. It never sees your real IP address.

Your Wi-Fi network and carrier still see your IP address, as always, but they only see a connection to the first relay.

The temporary address still matches your general region, so sites can show local weather and the right language. A typical VPN works differently. One company runs the only server in the middle, so that company can see your IP address and your destinations together.

What Private Relay Leaves Out

Private Relay has clear limits. First, it comes with iCloud+, Apple's paid iCloud plans, and it needs iOS 15 or later.

Second, it covers only some traffic. Apple lists three kinds.

• Browsing in Safari
• DNS lookups
• Unencrypted http:// traffic from apps

Encrypted traffic from other apps and other browsers goes out normally, with your usual IP address. That makes Private Relay much narrower than a full VPN.

Third, it isn't available everywhere. Apple says the feature isn't offered in all countries or regions. At launch in 2021, places including China, Belarus and Saudi Arabia were left out, with Apple pointing to local laws.

Some networks block it as well. Schools and businesses that must inspect their traffic can do this, and your iPhone then asks you to turn Private Relay off for that network or pick another one. A few websites may also ask for extra sign-in steps, since they can't see your usual IP address.