Apple blinked. After announcing a change to its Hide My Email feature that users widely criticized as gutting the service, the company has quietly reversed the decision and confirmed that masked addresses will stay on the @icloud.com domain. No explanation offered. No apology. Just a silent about-face.
According to TechCrunch, Apple confirmed the reversal in a Monday update, stating that Hide My Email addresses ‘will remain’ on @icloud.com. The company had previously said it would shift users to @private.icloud.com, a move that critics argued would instantly allow websites to identify and reject masked addresses during sign-ups. Which, if you think about it for five seconds, makes the feature completely pointless.
Hide My Email is available to paying iCloud+ subscribers. It generates a unique, disposable email alias that forwards messages to your real inbox. The core privacy benefit is that a masked @icloud.com address looks identical to any regular Apple email account, so websites cannot easily single it out for rejection. Moving users to a separate, clearly labeled domain would have stripped that anonymity by design.
John Gruber at Daring Fireball, who first reported the reversal, noted that Apple employees had objected to the @private.icloud.com change internally from the beginning. So why did the company announce the plan at all? That’s a question Apple has not answered, and probably won’t.
But before anyone crowns Apple as a privacy champion over this, some context matters. Hide My Email still does not protect you from Apple itself. The company retains the ability to connect a masked address back to your real identity, and it will do so in response to law enforcement requests. That’s not a bug, that’s policy. The feature limits what third-party websites and advertisers know about you, not what Apple knows.
There’s also the matter of a separate incident earlier this year. 404 Media reported that a bug in Hide My Email was leaking users’ real email addresses when messages were rejected as spam. Apple took more than a year to fix it after being made aware of the issue. That timeline says something about how seriously the company treats privacy problems when they aren’t generating headlines.
The reversal on @private.icloud.com is a genuine win for users who pushed back loudly on social media and Reddit. Collective pressure worked here. But it’s worth watching what Apple does quietly, not just what it announces.