Apple announced that it will not move Hide My Email addresses to the private.icloud.com domain, reversing a change it announced in mid-June. The reversal comes after significant user and security researcher pushback over privacy implications that would have made it trivial for websites to block the feature.
Hide My Email will continue to use the same icloud.com domain as standard iCloud email accounts. The decision shows how rapidly community feedback can force Apple to reverse course on decisions that threaten core privacy features, even after public announcement.
Why The Original Plan Would Have Broken Hide My Email
Websites would have been able to block Hide My Email addresses with a single domain rule if Apple had moved them to private.icloud.com. In June, Apple said it would unify the email domains used by Sign in with Apple and Hide My Email under that single private.icloud.com domain for organizational simplification.
Hide My Email generates unique disposable email addresses for each website, allowing users to mask their real identity. If those addresses all came from a dedicated private.icloud.com subdomain, any platform could trivially reject them with a single firewall rule. Using the same domain as regular iCloud email makes blocking Hide My Email impossible without also rejecting legitimate iCloud users, which no major platform would do.
Technical security researchers and privacy advocates flagged the problem within days of the June announcement. A dedicated subdomain would have gutted one of iCloud+ paid features’ core selling points.
What Apple Is Actually Changing Instead
Apple will move Sign in with Apple to private.icloud.com starting later this year, but Hide My Email stays on icloud.com. New Sign in with Apple addresses will be issued on private.icloud.com instead of the current privaterelay.appleid.com domain; existing addresses on privaterelay.appleid.com will continue to work and forward mail to users without interruption.
The company emphasized that only Sign in with Apple addresses will migrate; Hide My Email addresses are off the table. After reviewing community feedback Apple determined the Hide My Email change would undermine the feature’s effectiveness. The partial reversal splits the original unification: Sign in with Apple gets its own subdomain for organizational clarity, while Hide My Email retains the protection of sharing the main iCloud domain.
What Developers Need To Know
Apps and websites using Sign in with Apple must update their systems to accept addresses on both privaterelay.appleid.com and private.icloud.com:
- Email validation logic: Update regex patterns and domain allowlists to accept both domains
- Account systems: Test that sign-in flows do not reject the new private.icloud.com domain
- Domain blocklists: Review any firewall rules or security filters that might inadvertently block the new domain
Apple provided updated guidance through its developer portal to support the transition. The key difference is that Hide My Email addresses are not changing at all, only Sign in with Apple moves. Developers relying on either service should test both domains in staging before the rollout begins.
