Apple plans to change its Hide My Email privacy feature that could make it less effective
Apple is moving Hide My Email and Sign in with Apple addresses to the @private.icloud.com domain. This change raises concerns that anonymity will decrease as websites can more easily identify these signups. Separate reports indicate a vulnerability in the feature has leaked real email addresses.
What changed
New reports confirm the transition to the @private.icloud.com domain and highlight an unpatched flaw leaking real user addresses.
Live updates
-
Apple Modifies Hide My Email Domain Amid Privacy Vulnerabilities
confidence 80%Apple is moving Hide My Email and Sign in with Apple addresses to the @private.icloud.com domain. This change raises concerns that anonymity will decrease as websites can more easily identify these signups. Separate reports indicate a vulnerability in the feature has leaked real email addresses.
What's confirmed:
- Apple is shifting Hide My Email and Sign in with Apple to the @private.icloud.com domain.
- A flaw in the Hide My Email feature allows the exposure of real Apple ID email addresses.
Still unconfirmed:
- Apple was notified of the Hide My Email compromise in June 2025 and failed to release a fix.
- Cybersecurity researcher Tyler Murphy claims he could still recover real email addresses in tests after Apple stated the issue was fixed in March 2026.
-
Apple Unifies Hide My Email and Sign in with Apple Domains
confidence 95%Apple is moving Hide My Email and Sign in with Apple addresses to the @private.icloud.com domain. This unification makes it easier for websites and apps to identify and block anonymous signups. Developers must prepare their systems for the transition.
What's confirmed:
- Apple is unifying the email domains for Sign in with Apple and iCloud+ Hide My Email under the private.icloud.com domain.
- The domain change allows websites and apps to more easily identify and block users of anonymous aliases.
- Developers are required to prepare their systems before the transition occurs.
Still unconfirmed:
- The update may allow for the use of custom domains.
-
Apple moves Hide My Email aliases to private.icloud.com subdomain
confidence 90%Apple is shifting Hide My Email and Sign in with Apple addresses to a new subdomain. The transition will occur later this summer. This change allows websites to potentially identify and block these anonymous aliases.
What's confirmed:
- Apple will move Hide My Email and Sign in with Apple addresses to the private.icloud.com domain.
- The transition is scheduled for later this summer.
Still unconfirmed:
- Apple informed developers of this move on June 15, 2026.
- Apple provided a Hide My Email user's real account to a subpoena linked to the FBI director earlier in 2026.
- iCloud+ subscribers will receive no compensation for this change.
-
Apple moves Hide My Email and Sign in with Apple to single domain
confidence 90%Apple is transitioning anonymously generated email addresses to the private.icloud.com domain. This change applies to both Hide My Email and Sign in with Apple. Apple states that current logins will not be impacted.
What's confirmed:
- Emails for Hide My Email and Sign in with Apple will be issued from private.icloud.com.
- Apple says existing logins will not be affected by this change.
Still unconfirmed:
- The domain change could make anonymous sign-ups harder.
- The move may degrade the privacy power of the feature.
-
Apple merges Hide My Email and Sign in With Apple under one domain
confidence 90%Apple is moving anonymously generated email addresses to the private.icloud.com domain. This change aims to make privacy addresses easier to recognize and remember. Some reports suggest the move may degrade the privacy power of the feature.
What's confirmed:
- Apple is merging Sign in with Apple and iCloud+ Hide My Email under the private.icloud.com domain.
- The company announced the domain change to developers.
Still unconfirmed:
- The update significantly degrades the privacy power the feature previously held.
- The change could end up breaking iCloud+ Hide My Email.
-
Apple’s Hide My Email shift sparks privacy concerns over new domain move
confidence 98%Apple will consolidate Sign in With Apple and Hide My Email addresses under a single domain, private.icloud.com, in the coming weeks. The change may weaken anonymity by making it easier for services to detect and block these addresses. Privacy advocates warn the update could reduce the feature’s effectiveness without requiring user action. Developers may also face adjustments as a result.
What's confirmed:
- Apple will move both Sign in With Apple and Hide My Email addresses to a shared domain, private.icloud.com, in the coming weeks.
- Existing Hide My Email aliases will continue functioning but may become easier for services to identify and block.
- The update does not require any action from users but could impact developers adjusting to the new domain structure.
- Privacy advocates argue the change risks weakening the anonymity protections Hide My Email was designed to provide.
Still unconfirmed:
- Apple’s shift may lead to widespread account restrictions for users relying on Hide My Email aliases.
- The new domain could allow services to correlate Sign in With Apple and Hide My Email activity more easily.
-
Apple unifies Sign in With Apple and Hide My Email domains, raising privacy concerns
confidence 97%Apple will move both Sign in With Apple and Hide My Email addresses to a single shared domain, private.icloud.com, in the coming weeks. While existing aliases will continue working, the change may make it easier for services to detect and block these addresses. Privacy advocates warn this could weaken the feature’s effectiveness. The update requires no action from users but may impact developers.
What's confirmed:
- Apple will move new Sign in With Apple and Hide My Email addresses to a single shared domain, private.icloud.com, later this summer.
- Existing Hide My Email and Sign in With Apple addresses will remain functional and continue forwarding messages without interruption.
- The change does not disable the Hide My Email feature but may make generated addresses more recognizable to services attempting to block automated or anonymous sign-ups.
- Developers will need to update their systems to support the new private.icloud.com domain for these services.
- Sign in With Apple previously used privaterelay.appleid.com, while Hide My Email had its own distinct domain structure.
Still unconfirmed:
- Apple’s move could significantly reduce the privacy benefits of Hide My Email by making aliases easier to identify and block.
- Some reports suggest this change may discourage services from accepting Apple-generated email addresses, though Apple has not confirmed this as an intent.
- There are unconfirmed claims that this shift could lead to broader industry adoption of blocking mechanisms for iCloud-related email aliases.