A California iPhone user has filed what he hopes to become a class action lawsuit against Apple over a “Hide My Email” flaw that could expose a user’s real email address. (PDF) The proposed class action lawsuit claims Apple violated California’s false advertising laws and other California consumer protection statutes due to offering a feature that it knows does not work as advertised.
In June, we reported that a vulnerability in Apple’s Hide My Email service can allow almost anyone to discover your real email address that is hidden behind a generated alias. As reported by 404 Media, Apple has not addressed the flaw, even though it was reported more than a year ago.
While the publication has not provided technical details about the vulnerability, as it is still in the wild, it has verified the issue with one of its own Hide My Email addresses. Multiple tests by the researcher who discovered the flaw show that any Hide My Email address was vulnerable to the flaw.
Hide My Email is an iCloud+ feature that allows users to generate random alias email addresses, hiding their real email address when signing up for online services or when emailing third parties. The feature is promoted as a way for a user to protect their real email address from spam, data breaches, and unwanted identification.
Tyler Murphy, co-founder of EasyOptOuts, discovered the issue and reported it to Apple back in June 2025, along information on how to replicate it. Apple acknowledged the report a month later and said it was investigating.
Anthony Alvarez’s proposed class action lawsuit, filed against Apple in the U.S. District Court for the Northern District of California on Wednesday, July 15, does not allege that the vulnerability had been used in an attack or that the plaintiff’s email address had been exposed. It instead rests on the marketing of Hide My Email, accusing Apple of false advertising, fraud, and more.
The filing argues that Apple sold customers a privacy feature it couldn’t actually provide.
Alvarez’s lawsuit seeks to lawsuit seeks damages and an order requiring Apple to fix Hide My Email or clearly disclose its limitations by asking to represent four proposed classes covering U.S. Apple customers, including two California subclasses.