How iCloud Private Relay Stops ISP Tracking on iOS 15

iCloud Private Relay is an iOS 15 privacy feature designed to stop internet service providers (ISPs), network administrators, and third-party trackers from building profiles based on your Safari browsing activity. By utilizing an innovative dual-hop architecture, Private Relay encrypts your web traffic and splits the handling of your identity and your destination across two separate entities, ensuring no single party can see both who you are and what websites you visit.

Under standard internet connections, whenever you visit a website, your ISP and local network operators can view your Domain Name System (DNS) requests and IP address. This allows them to monitor the domains you access, create a history of your online behavior, and potentially sell that data to advertisers.

Private Relay stops this tracking mechanism through a two-hop relay system:

• The Ingress Proxy (The First Hop): When you navigate to a website in Safari, your DNS requests and browsing traffic are encrypted directly on your device. The connection first passes through an Apple-operated proxy server. Apple can see your original IP address, which reveals your identity and rough location, but it cannot decrypt the destination URL you are requesting.
• The Egress Proxy (The Second Hop): Traffic is then routed to a second proxy operated by an independent, third-party content delivery network (such as Cloudflare, Fastly, or Akamai). This second relay decrypts the web address you want to access and assigns you a temporary, generic IP address that corresponds to your general region. However, the second relay never receives your actual IP address.

Because of this separation, traditional third-party network providers—including your home ISP, cellular carrier, and public Wi-Fi providers—only see that your device is communicating with Apple's relay server. They cannot read the encrypted DNS queries or track the specific websites you load. Furthermore, websites you visit cannot trace your connection back to your specific home IP address, preventing cross-site behavioral tracking while maintaining your general regional access for local search results.