Apple Reverses Course: Hide My Email Stays on @icloud.com
Apple confirmed on August 24, 2026, that Hide My Email addresses will remain on the @icloud.com domain, walking back a plan announced in June to move the feature to @private.icloud.com. Sign in with Apple, a separate but related feature, will still migrate to the new private.icloud.com domain as planned. AppleInsider
The original plan appeared in Apple developer documentation dated June 15, 2026. The idea was to unify the email domains used by Sign in with Apple and iCloud+ Hide My Email under one shared domain: private.icloud.com. Users pushed back quickly, and the concern was straightforward. An address ending in @private.icloud.com would be trivially easy for websites to pattern-match and reject during sign-up, defeating the entire purpose of the feature. TechCrunch Hide My Email, available to paying iCloud+ subscribers, generates unique, disposable email addresses that forward messages to a user's real inbox while keeping the actual address hidden from the website receiving the address. TechCrunch
John Gruber of Daring Fireball first reported the reversal and noted that Apple employees had objected to the domain change internally from the start. TechCrunch Apple itself offered no reason for the about-face.
The reversal comes against a backdrop of documented security issues with the feature. 404 Media reported that a vulnerability in Hide My Email leaked users' real email addresses when messages were rejected as spam. The bounce-back notifications exposed the masked sender's actual address to the recipient. Apple fixed the bug more than a year after first being made aware of it. Separately, 404 Media documented that Apple can and does unmask Hide My Email users to law enforcement, providing a real name behind a masked address to the FBI. TechCrunch
The broader context here is that "privacy" in a service like Hide My Email is narrower than it sounds. The feature protects users from third-party data harvesting and email-based tracking. It does not provide anonymity from Apple itself or, by extension, from law enforcement with the appropriate legal process. That is a design choice, not a flaw, but it is the kind of distinction that matters when evaluating what a privacy feature actually delivers.
On the domain question specifically, the user feedback was correct. Any subdomain that telegraphs "this is a disposable address" invites blocklists. Email validation libraries and fraud-detection services already flag known disposable-address providers. An @icloud.com address is indistinguishable from a standard Apple user's primary address, which is precisely what makes the feature effective. Moving to @private.icloud.com would have eroded that property.
Apple's August 2026 has been busy on other fronts as well. The company announced a new Mac Studio with M5 Max and M5 Ultra chips, a refreshed Mac mini featuring the all-new M6 and M5 Pro, and described the M6 and M5 Ultra as a significant leap in performance and AI compute. It also announced EU app ecosystem changes on August 18, opened an Advanced Manufacturing Center in Houston on August 13, and added two titles to Apple Arcade on August 11. None of these are connected to the Hide My Email reversal, but the density of announcements shows how many parallel tracks Apple is running simultaneously.
The internal dissent Gruber reported is worth noting. When Apple employees tasked with building a feature object to a decision about that feature, and the decision is then reversed, the most natural reading is that the engineering and product teams made their case on the merits and eventually prevailed. That speaks to a functional internal feedback loop, which is not something every company at Apple's scale can be assumed to have.
For developers, the practical takeaway is minimal. Sign in with Apple's domain migration proceeds as planned. Hide My Email continues to operate on @icloud.com. No action is required for existing relay addresses, and new ones will be generated on the same domain they always have been.
