Apple scraps plan to move Hide My Email to dedicated privacy domain
The company reversed a decision to use @private.icloud.com after realizing the move would allow websites to easily identify and block masked addresses.
Apple has abandoned a plan to migrate its "Hide My Email" addresses to a dedicated @private.icloud.com domain. The reversal ensures that masked addresses remain indistinguishable from standard iCloud accounts, preserving the core utility of the privacy tool.
According to a developer note on Apple's website, the company originally intended to implement the domain change in June. However, Apple reversed this decision in late August 2026. By continuing to use the standard @icloud.com domain, the company prevents third-party websites from easily flagging and blocking addresses specifically generated through the masking service.
The mechanics of email masking
Hide My Email is a premium feature available to iCloud+ subscribers. It allows users to generate unique, random email addresses that forward messages to their primary inbox, ensuring that the user's actual identity remains hidden from the service or website they are interacting with.
This policy reversal follows a period of heightened scrutiny for the feature. Earlier this year, a vulnerability was discovered that potentially exposed users' real email addresses. Apple patched that security flaw following a report by 404 Media, highlighting the ongoing technical challenges in maintaining absolute anonymity for millions of users.
Why the domain change mattered
The proposed shift to @private.icloud.com would have created a permanent, visible "flag" for any company collecting user data. If a domain explicitly signals that an address is masked, it becomes trivial for websites to implement filters that reject such emails during the signup process.
Such a move would have effectively neutralized the feature's primary purpose. By forcing users to provide their real email addresses to access services, the @private.icloud.com domain would have incentivized the very data collection and tracking that Hide My Email was designed to prevent. The decision to stick with the generic @icloud.com domain removes this incentive for websites to discriminate against privacy-conscious users.
What to watch
While the domain issue is resolved, the incident underscores the tension between platform-level privacy tools and the data-collection models of the broader web. Users should continue to monitor for updates regarding iCloud+ security, particularly as Apple attempts to balance ease of use with the technical requirements of masking identities at scale. It remains to be seen if other tech giants will attempt similar domain-based masking and whether those efforts will face similar pushback from the developer community.