What the lawsuit alleges
Anthony Alvarez, the lead plaintiff, says Apple became aware of a vulnerability in the Hide My Email system back in June 2025. He claims the issue went unfixed for more than a year, with Apple making false assurances about resolving it. According to the lawsuit, the flaw could expose the real email addresses of users who rely on the feature to protect their privacy. This is the core accusation driving the case.
The Hide My Email feature was introduced as part of Apple's 'Sign in with Apple' framework, designed to let users register for online accounts without sharing their actual email addresses. The basic version is offered at no cost to all Apple users, while a more comprehensive version is included in iCloud+ subscriptions, which start at $0.99 per month. Alvarez argues that Apple continued collecting money from users, including iCloud+ subscribers, despite knowing the flaw had existed for over 14 months.
History of privacy concerns at Apple
The lawsuit also references Apple's track record of privacy issues, pointing specifically to a 2023 report that exposed a flaw in the company’s MAC address randomization feature. That feature, like Hide My Email, was marketed as a way to protect user data. The report found that in some cases, the system failed to prevent exposure of users' hardware identifiers. Alvarez is using this to argue that Apple has a recurring pattern of failing to uphold the privacy assurances it makes in its marketing.
According to a report from 404 Media, a security researcher initially raised concerns about the flaw in Hide My Email back in June 2025. Apple responded in July 2025, acknowledging the issue, but the flaw remained unresolved. By March 2026, the same researcher found the vulnerability was still present. Apple told the researcher it was planning to release a patch soon, but by the time the lawsuit was filed, the problem had not yet been corrected.
What Alvarez is asking for
Alvarez is seeking a class-action certification from the court. If granted, the case would represent four groups: all Apple users who have used Hide My Email, a subset of those users in California, all iCloud+ subscribers who used the feature, and iCloud+ subscribers in California. He is also requesting a jury trial and that Apple either fix the flaw or make its limitations clear to users.
The lawsuit states that the total potential value of the claims from class members is over $5 million. However, it does not provide any details on how that figure was determined. Apple has not publicly commented on the case at this time.
The case highlights how privacy claims in tech are often tested under real-world conditions. If the allegations are proven, it could raise broader questions about how companies handle user data and whether users are being adequately protected when they pay for privacy-related features.