iCloud Private Relay on Mac: What It Hides

Private Relay is the iCloud+ feature that stops websites and networks from profiling you by IP address — and it's designed so that not even Apple can connect who you are with what you browse. It's useful, quietly running, and regularly mistaken for both a VPN and the cause of broken websites. Here's what it actually does on a Mac.

How the two hops work

When Private Relay is on, Safari traffic leaves your Mac encrypted and passes through two separate relays:

• Hop one is run by Apple. It can see your IP address (it has to, to receive your traffic) but not the site you're visiting — the destination is encrypted.
• Hop two is run by a third-party partner (content providers like Cloudflare, Akamai, and Fastly). It decrypts the destination and fetches the site, but only ever sees a temporary relay IP — never yours.

No single party — including Apple — sees both your identity and your browsing. Websites see an anonymised IP shared with other Private Relay users in your region. That's also the key difference from a VPN: a VPN operator can see everything and asks you to trust them; Private Relay is built so there's nobody to trust.

What it covers — and the big gaps

Coverage is narrower than people assume. Private Relay protects:

• All browsing in Safari,
• DNS queries (which sites you look up), and
• insecure HTTP traffic from any app.

It does not cover Chrome, Firefox, or any other browser, nor the encrypted traffic of ordinary apps — Slack, Mail, games — which connect directly as usual. It also doesn't hide which country or rough region you're in, and it only works while you're subscribed to iCloud+. If you need every app on the machine tunnelled, you want a VPN, not Private Relay.

Turn it on, and set how much location leaks

1. Open System Settings, click your name, then iCloud.
2. Click Private Relay and switch it on.
3. Under IP Address Location, choose Maintain general location (sites can localise weather, news, and search — the default) or Use country and time zone (coarser, more private, more sites will guess your city wrong).

When sites misbehave — and how to turn it off

Because your visible IP is shared and regional, some sites throw extra CAPTCHAs, show the wrong region, or block you outright; corporate networks and some streaming services dislike relays on principle. You have three levels of off-switch:

• Per network: System Settings → Wi-Fi → Details… next to the connected network → turn off Limit IP address tracking. Private Relay stays on everywhere else but skips this network — the right fix for a work network that breaks with it.
• Entirely: the same Private Relay toggle in iCloud settings. Turning it off is instant and just as instantly reversible.
• Temporarily: when Private Relay itself has an outage, macOS notifies you and sites connect directly until it recovers.

One habit worth keeping: if a checkout page or bank behaves strangely, try flipping Private Relay off before blaming the site — relay IPs trip fraud filters more often than anything else on this list.

The error messages you'll actually see

Networks that block the relay produce a specific macOS alert — "Your network settings prevent Private Relay from working" or a note that the network is not compatible — usually because the router or its DNS filter blocks the relay hostnames. You then get a choice per network: skip Private Relay on it, or refuse to browse without protection. School and office networks trigger this legitimately (administrators are allowed to block it); a home network doing it usually means an over-eager ad-blocking DNS setting on the router. Availability also varies by country — Private Relay isn't offered in a handful of regions, and no toggle will appear there at all.

Complete the iCloud+ privacy kit

Private Relay hides where you go; Hide My Email hides who you are on signup forms. Together they cover the two ways sites track you most.