How iCloud+ Hide IP Address Works in Safari

The "Hide IP Address" feature in Safari on iOS 15 provides iCloud+ subscribers with advanced privacy by preventing websites and network trackers from profiling them based on their internet protocol (IP) address. Integrated directly into Apple's iCloud Private Relay infrastructure, this setting decouples your personal identity and location from the browsing data you generate, ensuring that neither Apple nor the websites you visit can construct a complete profile of your online activity.

The Dual-Hop Architecture

The core mechanism behind the feature is a "dual-hop" relay architecture. When you browse the web in Safari with this feature enabled, your internet traffic passes through two separate, encrypted relays:

  1. The Ingress Relay (Operated by Apple): Your device encrypts your DNS requests and web traffic. Apple receives this traffic and can see your actual IP address to determine your general region, but the encryption prevents Apple from seeing the website URL you are attempting to visit.
  2. The Egress Relay (Operated by Third-Party Partners): Apple passes the encrypted traffic to an independent third-party content delivery network (such as Cloudflare, Akamai, or Fastly). This relay decrypts the web address you want to access and assigns you a temporary, anonymous IP address. Crucially, the egress relay never receives your actual IP address.

Because neither entity possesses both your identity (original IP address) and your destination (the website), your browsing habits remain confidential.

Configuration Options in iOS 15

Within iOS 15, the setting is managed under Settings > Safari > Hide IP Address. Users with an active iCloud+ subscription have two operational modes:

  • From Trackers Only: Safari blocks known web trackers identified by Apple's built-in Intelligent Tracking Prevention (ITP) from viewing your IP address, while allowing the destination websites themselves to see it normally.
  • From Trackers and Websites: This activates full iCloud Private Relay routing for all Safari browsing. Every website you navigate to is routed through the dual-hop system, completely shielding your IP from all visited domains.

Location Preservation

Unlike tools designed to spoof locations, the Hide IP Address feature maintains standard web functionality by preserving localized content. In your iCloud Private Relay settings, you can choose how your assigned IP behaves:

  • Maintain General Location: Safari provides an IP address matching your general city or region, allowing local search results, weather, and maps to work accurately without revealing your exact address.
  • Use Country and Time Zone: Safari provides an IP address matching only your country and time zone, offering greater anonymity at the cost of localized website features.

Differences from a Standard VPN

While it functions similarly to a Virtual Private Network (VPN), the Safari implementation differs in key ways. It primarily protects Safari traffic and unencrypted app traffic, rather than encrypting the entire device's network activity. Additionally, it does not allow users to select custom server locations in other countries to bypass geographic streaming restrictions. Instead, it is designed strictly as a zero-knowledge privacy tool that prevents cross-site tracking and digital fingerprinting.