Your iPhone’s “Privacy” Feature Might Be Exposing You Right Now
You’re sitting in a co-working space in Petaling Jaya, phone in hand, browsing a competitor’s vendor list. You’ve got iCloud+ subscribed because you need the storage, and you’ve turned on Private Relay because you don’t want anyone to know you’re doing competitive research. You feel safe. You’re not.
On August 5, 2026, TechCrunch reported that Apple’s Private Relay can be bypassed, revealing your real IP address. Security researchers Talal Haj Bakry and Tommy Mysk found the flaw and even built a test website referenced in the TechCrunch article, where you can check if your device is leaking. TechCrunch tested it and confirmed the leak.
TL;DR: Private Relay is not a VPN. It only works inside Safari, and a trio of WebKit flaws can expose your true IP address to websites. If you’re an SME owner relying on this for business privacy, you’re operating with a false sense of security.
What This Means for You
Let’s say it plainly: Private Relay is a feature that routes your Safari traffic through Apple’s servers to mask your IP. But because of three features inside WebKit, websites can bypass that route and see your real IP. WebKit is the engine that powers every browser on iOS—not just Safari. So even if you switch to Chrome or Brave on your iPhone, the flaw still applies because Apple forces all browsers to use WebKit.
The researchers chose not to report the issue to Apple. In a post on X, Mysk wrote that their past experience with Apple involved months of delays and denial of impact. This is the same Apple that markets Private Relay as a privacy feature, but it’s not bug-proof.
| Key Fact | Details | Why It Matters |
|---|---|---|
| Three flaws | Three WebKit features cause the leak | It’s a systemic issue, not a one-off bug |
| Safari only | Private Relay works only in Safari | Your other apps and browsers are unprotected |
| iCloud+ needed | Only iCloud+ subscribers can enable it | Paying for privacy doesn’t mean you get it |
| Confirmed leak | TechCrunch verified the leak on their own device | It’s real, not theoretical |
How This Applies to Malaysian SMEs
Malaysian SME owners, you’re probably already using iCloud+ for a simple reason: you have an iPhone, and backing up your contacts, photos, and files to iCloud is the default move. Private Relay comes along as a bonus. You flick it on because you think it adds a layer of privacy when you’re browsing. You might even rely on it when you’re checking a supplier’s site in a sensitive negotiation, or researching market tactics from a competitor’s website in Hong Kong or Singapore.
But if your IP leaks, it’s like leaving your name card on every website you visit. Your real IP can be tied to your company’s building, your internet service provider, or your exact coordinates in a Kuching office or a Kuala Lumpur shop. Competitors or even malicious actors could use that to profile your interests, guess your plans, or launch targeted attacks. In a country where relationship damage is costly, privacy matters beyond compliance.
Think about your employees as well. Many Malaysian SMEs are what we call “small but nimble.” You have a family of staff using their phones for business messaging, email, and research. If you haven’t given them a system-level VPN, they’re exposed. Private Relay doesn’t cover WhatsApp, doesn’t cover your accounting app, doesn’t protect your email client. And now we know it doesn’t even protect Safari all the time. That means your company’s digital secrets are being shared on public Wi-Fi and with every ad network.
There’s also a compliance angle. The Personal Data Protection Act makes business owners accountable for the personal data they handle. If your team is using insecure connections to process customer orders or client information, and a leak happens because you relied on a broken feature, you’ll be the one answering questions, not Apple. This is especially relevant for SMEs dealing with e-commerce and customer marketing lists.
One practical tip: if you’re about to access anything sensitive—like a bank portal, a government filing system, or a client’s dashboard—make sure you are on a trusted VPN, not just Safari’s Private Relay. And if your business relies on “safe” browsing for competitive intelligence, consider a proper business VPN solution that routes all traffic securely.
What You Should Do Today
- Visit the test site mentioned in the TechCrunch article to see if your IP leaks. It takes less than a minute.
- Don’t assume Private Relay is protecting you anywhere outside Safari.
- For business devices, set up a reliable VPN that runs at the system level, not just in a browser.
- Educate your team: Private Relay is not a “secure internet” badge.
- Watch for Apple’s patch, but don’t wait. Your business security shouldn’t depend on a single vendor’s bugfix timeline.
The Bigger Picture
This is what happens when we hand over security to a brand and stop asking questions. Apple’s Private Relay is an amazing piece of marketing—it sells privacy as a subscription perk. But in practice, it’s a narrow, flawed feature that doesn’t cover the actual needs of a business.
“Our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue’s impact entirely.” — Tommy Mysk, Security Researcher
If even the researchers who found the flaw are tired of waiting for Apple to act, you should be proactive. The long-term takeaway for Malaysian SMEs is simple: security is your responsibility. You can’t rely on a default feature to be a bulletproof shield. Take inventory of the tools you use, test them, and set up real protection that covers every app you rely on.
The Private Relay leak is not just a piece of tech news. It’s a warning label for every business owner who turns on a “private” setting and goes back to their day. Don’t be the owner who finds out about the leak the hard way.
Ready to Streamline Your Operations?
Your business should run itself. AutoRunBiz deploys AI agents to automate your daily operations — WhatsApp orders, invoicing, customer follow-ups, and accounting. Book a free 15-min ops audit to see where automation fits your business →