How iOS 15 Private Relay Prevents Ad Tracking

iCloud Private Relay in iOS 15 stops third-party advertisers from linking your browsing history to your physical location by utilizing an innovative dual-hop proxy architecture. By separating the user's identity from their web destination through two distinct, encrypted relays, Apple ensures that no single entity—not even Apple itself—can see both who the user is and what website they are visiting.

Under traditional web browsing, a user connects directly to a website. In this process, network providers and third-party trackers can inspect DNS queries (the web domains you visit) and match them directly with your public IP address (which indicates your precise geographical location and internet service provider). Over time, advertising networks use this data pairing to build extensive behavioral profiles, targeting you based on where you live and the sites you visit.

Private Relay breaks this tracking mechanism by routing Safari traffic through two separate internet relays:

  1. The Ingress Proxy (Operated by Apple): When you send a request in Safari, your DNS records and browsing requests are encrypted on your device. The connection first routes through Apple’s ingress server. Apple can see your real IP address because it needs to route the connection, but it cannot see the encrypted web destination you are requesting.
  2. The Egress Proxy (Operated by Third-Party Partners): Before reaching the destination website, the encrypted data passes to an independent egress proxy run by content delivery networks like Cloudflare, Fastly, or Akamai. This secondary relay decrypts the web address you want to visit and assigns you a temporary, shared IP address based on your general geographic region. However, this egress partner never receives your actual IP address or your identity.

Because of this separation, third-party advertisers and websites only see the generic IP address provided by the egress relay. They can see that an anonymous visitor from a broad metropolitan area visited their site, but they cannot identify the user's true IP address.

Simultaneously, local network operators and ISPs only see encrypted connections leaving your device toward Apple's relay, blinding them to your ultimate browsing destinations. By decoupling your true identity and location from your web activity, Private Relay effectively eliminates the primary data points advertisers rely on to track your movements across the internet.