iCloud Private Relay: What is it, how does it work and why use it?

When Apple unveiled iOS 15 last month, it also showed off one of the biggest iCloud upgrades we've seen in years. But iCloud+ will offer much more features to protect users' privacy than just Hide My Email, which has been talked about the most. iCloud Private Relay is also interesting. Hide My Email is an extension of the feature known from iOS 13 when Sign in with Apple arrived, which allows users to easily set up dynamic private email addresses, not just those used with Apple ID. But iCloud Private Relay can be even more interesting. This VPN-like service helps you protect your online identity by completely hiding your IP address while browsing the web.

What is iCloud Private Relay 

In computer science, a virtual private network (VPN) is a means of connecting several computers via an untrusted computer network (e.g. the public Internet). It is thus easy to achieve a state where connected computers will be able to communicate with each other as if they were connected within a single closed private (and therefore mostly trusted) network. When establishing a connection, the identity of both parties is verified using digital certificates, authentication occurs and all communication is encrypted.

iCloud Private Relay is then an improved VPN, because this function is set in such a way that even Apple will not be able to track where you go. While most VPN providers promise to hide your real location from both your ISP (Internet Service Provider) and the websites you visit while browsing the VPN. This is because the company providing the VPN service generally knows what you are doing on the network, and there is little to no defense against this other than trusting the privacy policy.

Check out all the privacy-related news in iOS 15:

Gallery

iOS 15 Privacy Report

iOS 15 Hide My Email

iOS 15 App Privacy Report

iOS 15 App Privacy Report example

iOS 15 Hide My Email 2

iOS 15 Hide My Email iCloud Plus

iOS 15 HomeKit Secure Video

So Apple quite cleverly created its iCloud Private Relay with a "zero-knowledge" design, using two separate Internet "relays" that are separate from each other: “iCloud Private Relay is a service that lets you connect to virtually any network and browse it using Safari in an even more secure and private way. It ensures that the traffic leaving your device is encrypted so that no one can intercept and read it. After that, all your requests are sent through two separate internet relays. Everything is designed so that no one, including Apple, can use your IP address, location and browsing activity to create a detailed profile of you.” 

How iCloud Private Relay works 

Apple will route Private Relay traffic through two proxy servers—one owned by Apple and one owned by the content provider. Like a VPN, all traffic that passes through iCloud Private Relay is encrypted, and the first proxy server in the chain, the one owned by Apple, is the only one that knows your original IP address. However, this server, also known as an "inbound proxy", may not decrypt or inspect your traffic. It simply forwards everything to the other "outbound proxy" server.

To set up iCloud Private Relate on a Mac with macOS 12 Monterey:

Gallery #2

private_relay_macos_12_monterey_6

private_relay_macos_12_monterey_2

private_relay_macos_12_monterey_3

private_relay_macos_12_monterey_4

private_relay_macos_12_monterey_5

private_relay_macos_12_monterey_1

However, since this next proxy server gets all the data from the first server, it no longer knows where the data originally came from. All together it means that when you use iCloud Private Relay, no server ever knows who you are or where you go on the network. But you'll still be able to decide if you want to use at least a destination address that takes into account your general location (eg city or region), so local content like news and weather can still be recommended to you. Alternatively, you can tell iCloud Private Relay to use a more generic IP address that's simply somewhere in the same time zone in your home country, so the websites you visit won't even know what city you're in, let alone a more specific location.

What about iCloud Private Relay and limitations 

• Geographical restrictions: The IP address set by the exit server will always be somewhere in your home country. You will need a traditional VPN if you want to enjoy e.g. streaming services while traveling abroad. 
• Local network traffic is not encrypted: If you use your iPhone, iPad, or Mac to access internal websites at your business or school, iCloud Private Relay won't work with those networks at all. So it only works with the public internet. 
• VPN takes precedence: If you already use a VPN, all your traffic will be routed through its service provider. Depending on how your VPNs are set up, they may cause iCloud Private Relay to be completely disabled in your case when the VPN is running. 
• Individual apps can bypass iCloud Private Relay: By default, Apple will protect all web traffic that leaves your device, even if it comes from third-party apps. However, if the application uses a specific proxy server or adds its own VPN functions, this traffic will not go through the iCloud Private Relay service. 
• iCloud Private Relay bypasses router parental controls: Since all traffic is encrypted, even your home router doesn't know where you're going on your devices. That being said, he also can't stop you from actually going there, as can all household members. However, this does not affect Screen Time and other parental control apps, as they filter traffic before iCloud Private Relay affects them. 
• Price: The feature is included in every paid iCloud package, regardless of its amount, and there is no need to pay extra for it. If you don't pay for more storage, iCloud Private Relay will still be used to handle all traffic related to trackers and ad networks.