How iCloud Private Relay Works on iOS 15

iCloud Private Relay is a privacy feature introduced in iOS 15 designed to secure Safari browsing traffic by splitting it across two separate, independent internet relays. By employing a dual-hop architecture, the system guarantees that no single party—including Apple, the user's network provider, or the visited website—can simultaneously view both the user’s identity and their online destination.

The Problem with Standard Web Browsing

Under standard web browsing, a user's Internet Service Provider (ISP) and local network operators can view DNS queries and destination IP addresses, allowing them to track browsing habits. Simultaneously, destination websites receive the user's exact IP address, which can be combined with other identifiers to build detailed tracking profiles and pinpoint physical locations.

Relay 1: The Ingress Proxy (Apple)

When a user navigates to a website in Safari with Private Relay enabled, the device encrypts the DNS query and destination URL using multi-layered encryption before the data ever leaves the iPhone.

  1. Connection: The encrypted request is first transmitted to the ingress relay, which is owned and operated by Apple.
  2. What Apple Sees: Apple sees the user's original IP address because it manages the direct network connection to the device.
  3. What Apple Cannot See: Because the destination URL and DNS query are encrypted, Apple cannot see which website the user is attempting to visit.

Apple’s ingress relay strips the user's original IP address and assigns a coarse, regional geographic location (such as a general city or country) based on the user's settings, ensuring localized web services still function properly.

Relay 2: The Egress Proxy (Third-Party Partner)

After passing through the first relay, the traffic is forwarded to an egress relay operated by established third-party Content Delivery Networks (CDNs), such as Cloudflare, Fastly, or Akamai.

  1. Decryption: The second relay decrypts the final layer of the connection to reveal the destination web address.
  2. What the Partner Sees: The egress relay sees the target website URL.
  3. What the Partner Cannot See: The partner only sees traffic arriving from Apple’s ingress relay, meaning it has no access to the user's true IP address or identity.

The egress relay assigns a temporary, shared IP address that reflects the general region determined by the first relay.

Reaching the Destination Website

The request is ultimately delivered to the destination website from the egress proxy. The website receives the connection request, serves the content, and logs the temporary IP address provided by the second relay.

As a result:

  • The ISP and Local Network only see that the device is connected to an Apple relay.
  • Apple knows the user's identity and IP, but not the websites being visited.
  • The Egress Partner knows the destination website, but not who is visiting it.
  • The Destination Website sees the incoming request, but cannot trace it back to the user's real IP address.

By strictly separating identification from destination routing across two distinct entities, iOS 15 prevents user profiling while preserving standard web performance.