How iCloud Private Relay Obscures IP Addresses

iCloud Private Relay, introduced in iOS 15, is a privacy feature designed to prevent websites, network providers, and advertising networks from tracking Safari browsing activity. It achieves this by routing web traffic through a dual-hop architecture that separates a user’s identifying IP address from the destination URL they are visiting. By ensuring that no single party possesses both pieces of information, Private Relay effectively stops data brokers and advertisers from building comprehensive behavioral profiles based on browsing habits.

The Dual-Hop Architecture

Traditional web browsing transmits unencrypted DNS requests and an IP address directly to the internet service provider (ISP) and the destination server, allowing both to see who the user is and what site they are visiting. Private Relay replaces this direct connection with a two-hop relay system:

  1. The Ingress Proxy (Operated by Apple): When a user enters a web address in Safari, the request is encrypted. The first relay, managed by Apple, receives the connection. Apple can see the user’s real IP address because it receives the incoming connection directly from the iOS device. However, Apple cannot read the destination website because the DNS request is encrypted. Apple assigns an anonymous IP address that represents only the user's general geographic region.
  2. The Egress Proxy (Operated by Third-Party Partners): The traffic is then forwarded to a second relay operated by independent third-party content delivery networks (such as Cloudflare, Fastly, or Akamai). This second relay decrypts the destination web address to direct the user to the intended website. Crucially, the egress proxy only sees the generalized IP address provided by the first relay; it never sees the user's true IP address.

Disrupting User Profiling

Online advertisers rely heavily on static or semi-static IP addresses to track individuals across multiple websites, combining browsing history, location data, and time-stamped interactions into persistent consumer profiles. Private Relay disrupts this data collection in several key ways:

  • Separation of Identity and Destination: Because Apple knows the identity but not the destination, and the third-party proxy knows the destination but not the identity, neither entity can correlate a specific user with their browsing history.
  • Coarse Location Masking: Rather than sharing precise geographic coordinates derived from a residential IP address, Private Relay provides websites with a coarse location (such as a broad city or country level). This preserves localized search results, like weather or nearby businesses, without revealing an exact physical address.
  • Shared IP Pools: Multiple users are assigned addresses from the same shared pool of proxy IPs. This makes it impossible for tracking scripts to reliably distinguish one specific device from another based on network identifiers alone.

By masking the original IP address and encrypting DNS queries, Private Relay strips web trackers of the fundamental network identifiers required to monitor user behavior across the web on iOS 15.