iCloud Private Relay splits your traffic across two hops so no one sees both who you are and where you go. Here's what it covers, and what sites still see.
iCloud Private Relay is an Apple privacy feature for iCloud+ subscribers that sends your Safari traffic through two separate hops, so that neither Apple nor the second operator can see both your identity and the sites you visit. It is not a VPN: it covers only part of your traffic, it deliberately keeps your approximate location, and it leaves your browser fingerprint untouched. This guide explains what it hides, why a site may show you in the wrong city, and how websites recognise it.
Key Takeaways
- Private Relay uses two hops: Apple's ingress relay sees your real IP but not the destination, and a partner egress relay sees the destination but not your real IP.
- It covers Safari browsing, DNS lookups and some unencrypted app traffic — not your whole device the way a VPN does, and not other browsers such as Chrome or Firefox.
- Websites see an egress IP from a published relay range: identifiable as a relay, but not attributable to you. Its location is intentionally coarse, which is why you may appear in the wrong city.
- It does not change your browser fingerprint, and it can trip VPN or proxy checks that flag relay ranges.
- To see what a site sees, check your egress IP, ASN and location with the IP intelligence tool and test whether it reads as a proxy with the VPN/proxy check.
How the two hops split trust
With a normal connection, the site you visit sees your IP address and your ISP sees the site you asked for. A single-operator VPN moves all that knowledge to one company. Private Relay instead splits it:
- Ingress hop (Apple). Your device sends the request to an Apple-operated relay. Apple knows your real IP address but only sees an encrypted request it cannot read, so it does not learn which site you want.
- Egress hop (a partner). The second relay, run by a partner such as Cloudflare, decrypts the destination and forwards the request. It assigns the outgoing IP, so it knows where the request is going but only sees Apple's relay as the sender.
This split-trust design is the same idea summarised in our privacy tools comparison, and Cloudflare's own write-up, iCloud Private Relay: What Cloudflare Customers Need to Know, describes the egress side from the partner's perspective. Chrome tried a similar two-hop design; see Chrome IP Protection for how that compares and why it was retired.
The protocol layer: MASQUE
For readers who want the plumbing: Private Relay's tunnels use the approach standardised by the IETF's MASQUE working group, which carries other traffic inside HTTP proxy connections. RFC 9298 defines proxying UDP in HTTP, and its sibling RFC 9484 extends the same idea to whole IP packets. The point for users is that the relay hops run over ordinary HTTP/3 (QUIC) connections, which look like normal web traffic to the network in between. You don't need to know any of this to use the feature, but it explains why Private Relay is built on open standards rather than a proprietary VPN protocol.
What Private Relay covers — and what it doesn't
| Traffic | Protected by Private Relay? |
|---|---|
| Safari browsing (HTTP and HTTPS) | Yes |
| DNS lookups through the system resolver | Yes |
| Some unencrypted app traffic | Yes |
| Chrome, Firefox and other browsers | No |
| Most other apps and system services | No |
| Your browser fingerprint | Not changed |
| Traffic timing and volume | Not hidden |
Two consequences follow. First, a site in Chrome sees your real IP even when Safari is relaying. Second, anything that identifies you without your IP — cookies, a login, canvas or font fingerprints — works exactly as before. If the DNS part is your concern, our DNS leak prevention guide covers how lookups escape other tools.
Why a site shows you in the wrong location
Private Relay offers a location setting: keep a general location (your approximate region, so local content still works) or use only country and time zone (a broader, more private option). In both cases the egress IP is drawn from a pool assigned to a region rather than your actual address, so geolocation databases place you at that region's centre — often a nearby city, sometimes not the right one.
That is not a bug in the site or in your device; it is the feature working. How databases then turn an IP into a city, and why those guesses drift, is covered in IP geolocation accuracy, so we won't repeat it here. If a store shows prices for the wrong region, or a weather widget names the wrong town, check whether Private Relay is on in your Apple ID settings before assuming a fault.
How websites recognise Private Relay
Apple publishes the list of egress IP ranges it uses, so any site can match a visitor's address against it. The result is a connection that is identifiable as a relay but not attributable to you: the site learns "this visitor is behind iCloud Private Relay", not who they are. Many sites treat that as harmless; some treat it like any proxy.
Because the egress range is known, the signals line up like this:
- IP reputation and ASN. The address belongs to a partner network, not a home ISP. Our IP intelligence tool shows the ASN and type a site would see.
- Consistency checks. If your time zone and language say one country while the egress IP says another, anti-fraud systems may add risk. Private Relay is designed to avoid this: both location settings keep your egress IP in your real country and time zone, which is a key difference from a VPN exit in another country.
- Proxy flags. Some VPN and proxy detectors list relay ranges and challenge or block them even though the user did nothing wrong. See why genuine users get flagged as VPN users for how those false positives arise and what to do.
What Private Relay does not do
It is easy to over-read the name. Private Relay does not:
- Change your browser fingerprint. Your user agent, screen, fonts, canvas and WebGL output are all still sent. A fingerprint can recognise you across sites regardless of which IP you appear from; our comparison of VPNs and fingerprinting explains why masking an IP and defeating tracking are different jobs.
- Cover other browsers or the whole device. Only the traffic the feature handles is relayed.
- Let you pick an exit country. You can't choose where you appear, so it is not a tool for streaming catalogues or beating regional blocks.
- Hide that a relay is in use. The ranges are public, which is part of the design.
When Private Relay is off without you noticing
If you expected to see a relay IP and see your home IP instead, the feature is usually not running for that connection. Common reasons:
- No iCloud+ subscription. Private Relay is part of the paid iCloud+ plan, not free iCloud.
- Not offered in your region. Apple does not provide Private Relay in some countries and regions, including mainland China.
- Turned off for this network. On iPhone and iPad you can disable it per Wi-Fi or cellular network, and some school, workplace or public networks block it; your device then connects directly and usually shows a notice in network settings.
- Not Safari. A check run in Chrome or Firefox will always show your real IP.
The quickest way to confirm is to open the IP intelligence tool in Safari, note the IP and ASN, then repeat with Private Relay switched off.
Private Relay vs a VPN vs Chrome's approach
A VPN routes your whole connection through one operator you must trust, lets you pick a location, and also exposes you to blocklists for datacenter IPs. Private Relay trades that flexibility for split trust and zero configuration. Chrome's retired IP Protection was narrower still: only a list of tracker domains, only in Incognito. For choosing among all of these, see the privacy tools comparison.
Frequently Asked Questions
Does iCloud Private Relay hide my IP address?
From the websites you visit in Safari, yes: they see a relay egress IP instead of your own. Your ISP still sees that you are connecting to Apple's relay, and traffic outside Safari is not covered.
Is iCloud Private Relay the same as a VPN?
No. A VPN sends all device traffic through one provider and lets you choose a location. Private Relay splits trust across two operators, covers mainly Safari and DNS, and does not let you pick a country.
Why does iCloud Private Relay show the wrong location?
It deliberately assigns an egress IP from a regional pool, or only preserves your country and time zone. Geolocation databases then place you at that region, which can be a different city from where you are.
Can websites detect iCloud Private Relay?
Yes, because the egress ranges are published. A site can tell a visitor is using a relay, but it cannot tell who the visitor is from the IP alone.
Does Private Relay change my browser fingerprint?
No. Fingerprinting signals come from your browser and device, not your IP. You can check what your browser exposes with the fingerprint check.
Conclusion
iCloud Private Relay is a well-designed, low-effort way to stop sites and your network from pairing your IP with your browsing in Safari. It is not a full VPN, not a fingerprint defence, and not invisible to websites. Run the IP intelligence tool and the VPN/proxy check with it on and off to see exactly what changes.
Recommended Reading:
