Apple keeps Hide My Email on @icloud.com after backlash over domain change

Apple reverses course on Hide My Email

Apple has scrapped a plan that would have moved its Hide My Email feature to a dedicated domain, according to TechCrunch. The company confirmed on Monday that aliases created by the feature "will remain" on @icloud.com, walking back an earlier decision to shift them to @private.icloud.com.

How the feature works

Hide My Email is offered to paying iCloud+ subscribers. It generates unique, disposable email addresses that a user can hand to websites and newsletters instead of their real address, with incoming messages forwarded on to their ordinary inbox. As TechCrunch explains, the feature draws much of its power from blending in: because the aliases sit on the same @icloud.com domain used by ordinary Apple customers, there is no simple way for a website to detect that a sign-up used a masked address.

The privacy it provides is aimed at third parties rather than at Apple itself. The company can still identify who is behind a masked address and pass that information to law enforcement.

The backlash

Earlier this year, Apple said it would move Hide My Email users to @private.icloud.com. The proposal drew criticism on social media and Reddit, where users argued that a separate domain would make masked addresses trivial to spot. Websites could simply block or flag anything ending in @private.icloud.com during sign-up, which critics said would undermine the service, since the whole point of a disposable alias is that the recipient cannot easily tell it apart from a normal address.

Inside the reversal

Apple has not publicly explained why it changed its mind. John Gruber of Daring Fireball, who first reported the about-face, said Apple employees had objected to the domain change from the start, TechCrunch reports.

A feature with a rocky record

The episode is not the first controversy around Hide My Email. Earlier this year, 404 Media reported that a bug in the feature exposed users' real addresses: when an email was rejected as spam, the rejection leaked the genuine address behind the masked alias. According to TechCrunch, Apple fixed the flaw more than a year after it was first alerted to the problem.

Why it matters

Hide My Email is one of the few privacy tools built into a service used by hundreds of millions of people, and its usefulness rests on a technical detail as small as a domain name. Moving aliases to a dedicated domain would have given every website a one-line filter to defeat them, so the decision to stay on @icloud.com preserves the feature's core value for iCloud+ subscribers.

The reversal also shows that both user pressure and internal dissent can move a company as large as Apple, even if it declines to say which mattered here. At the same time, the episode is a useful reminder of the feature's boundaries: it shields users from trackers, marketers and data brokers, but not from Apple or from legal process, and its track record includes a bug that leaked the very addresses it was meant to protect.