How iOS 15 Private Relay Routes Web Traffic

iCloud Private Relay in iOS 15 is a privacy feature designed to secure Safari browsing by routing web traffic through a dual-hop network architecture. By splitting data transmission across two separate, independent internet relays, the system ensures that no single entity—including Apple, network providers, or destination websites—can link a user's identity directly to their online activity.

The Dual-Hop Architecture

Traditional Virtual Private Networks (VPNs) route all encrypted traffic through a single provider, requiring the user to trust that provider with both their identity (IP address) and browsing activity (destination URL). Private Relay replaces this model with a two-hop relay system based on modern internet protocols like QUIC and MASQUE.

When a user accesses the internet via Safari or sends unencrypted HTTP traffic from an app, the device encrypts the request using multi-layered encryption before it leaves the phone.

Relay 1: The Ingress Proxy (Apple)

The first relay, known as the ingress proxy, is operated directly by Apple.

  1. IP Visibility: The ingress proxy receives the encrypted packet from the iOS 15 device and can see the user’s original IP address and network connection.
  2. Encrypted Destination: Because the destination URL is protected by an inner layer of encryption, Apple cannot see the website the user wants to visit.
  3. Location Assignment: Apple strips the exact IP address and assigns an approximate, coarse IP address to the traffic. This preserves general geographic context (such as city or region) to maintain localized web services while obscuring the specific user location.
  4. Forwarding: Apple forwards the request to the second relay without logging the browsing destination.

Relay 2: The Egress Proxy (Third-Party Partners)

The second relay, known as the egress proxy, is managed by trusted, independent third-party network providers such as Cloudflare, Fastly, and Akamai.

  1. Decryption: The egress proxy receives the packet and decrypts the inner layer of encryption, revealing the target web address (URL).
  2. Identity Blindness: Because the traffic arrived from Apple's ingress relay, the egress proxy has no visibility into the original user's IP address. It only sees the relay address provided by Apple.
  3. Completion: The third-party relay sends the web request to the destination server using the localized IP address.

The Resulting Privacy Guarantee

By separating identity from browsing intent through independent entities:

  • Apple knows who you are, but not where you are going.
  • The Third-Party Partner knows where you are going, but not who you are.
  • The Destination Website sees the generalized IP from the egress relay, preventing cross-site profiling based on personal IP addresses.
  • Network Operators and ISPs cannot inspect DNS queries or destination URLs because DNS lookups are tunneled through Oblivious DNS-over-HTTPS (ODoH).

This architectural separation ensures that even if one relay were compromised or compelled to share logs, the user's complete browsing profile cannot be reconstructed.