How iCloud Private Relay Protects Privacy on iOS 15

iCloud+ Private Relay is a privacy feature introduced in iOS 15 designed to secure your Safari web browsing. By utilizing an innovative dual-hop architecture, it encrypts your internet traffic and separates your identity from your browsing destination. This system ensures that no single entity—not your internet service provider (ISP), not network eavesdroppers, and not even Apple—can see both who you are and which websites you visit.

The Dual-Hop Architecture

Traditional browsing allows your ISP and the websites you visit to build a profile of your activity by linking your IP address directly to the domains you request. Private Relay breaks this chain of information using two separate internet relays:

  1. The Ingress Proxy (First Hop): Operated by Apple, this first relay receives your encrypted web traffic. It knows your original IP address because your device connects directly to it. However, it cannot see the DNS request or the destination website you are trying to visit, as that data is encrypted.
  2. The Egress Proxy (Second Hop): Operated by trusted third-party content delivery networks (such as Fastly, Cloudflare, and Akamai), this second relay decrypts the destination URL to connect you to the requested website. It assigns you a temporary, random IP address. Because this relay only communicates with the first proxy, it never sees your real IP address or your device's identity.

By separating the browsing process into these two distinct steps, user identity and browsing destination are never accessible to a single party.

DNS Query Encryption

Normally, whenever you type a web address into a browser, your device sends a DNS (Domain Name System) lookup request in plain text. Local network operators and ISPs routinely monitor and log these lookups to track your behavior or sell your browsing history. Private Relay encrypts all DNS lookups at the device level, preventing anyone on the local network from intercepting and recording the domains you access.

IP Address and Location Masking

Websites use your IP address to pinpoint your geographical location, track your behavior across the internet, and deliver targeted advertising. Private Relay prevents this by hiding your actual IP address. In iOS 15, Apple offers two distinct location settings for Private Relay:

  • Maintain General Location: Provides an IP address that reflects your approximate city or region, allowing websites to display relevant local content (such as weather or local news) without identifying your precise physical location.
  • Use Country and Time Zone: Provides a much broader IP address that only indicates your country and time zone, maximizing privacy at the expense of localized website experiences.

Scope of Protection

Private Relay applies privacy protections specifically to:

  • All web traffic routed through Safari.
  • DNS resolution queries initiated on your device.
  • Unencrypted HTTP traffic originating from native iOS applications.

Because it operates at the networking layer for these specific channels, it shields your activity even on unsecured public Wi-Fi networks without requiring manual configuration or third-party software.