> ## Content Index > Fetch the complete content index at: https://techlore.tech/llms.txt > Use this file to discover other available public pages before exploring further. # Apple's Private Relay Is Leaking Your IP, Plus Fake VPN Extensions & France's Big Win - URL: https://techlore.tech/apples-private-relay-is-leaking-your-ip-plus-fake-vpn-extensions-frances-big-win/ - Published: 2026-08-21T00:57:33.000Z - Updated: 2026-08-21T00:57:33.000Z - Description: Apple's iCloud Private Relay is still leaking real IP addresses weeks after disclosure and other Apple issues. Plus 737 fake VPN extensions and France's age-check loss. - Author: Henry Fisher - Tags: Surveillance Report 📰 Listen to the weekly podcast on [Apple Podcasts](https://podcasts.apple.com/us/podcast/techlore-surveillance-report/id1507714387), [Spotify](https://open.spotify.com/show/5rxm041iDXxe0rINwO5G0c), other [podcast apps](https://pod.link/1507714387), or [RSS](https://feeds.transistor.fm/techlore-surveillance-report). You can also watch Surveillance Report on [YouTube](https://youtube.com/playlist?list=PL3KeV6Ui%5F4CZemCIsHUIuEtugAmUxAYHS) or [Techlore.TV](https://techlore.tv/w/p/twkcDETcDauUXuaGNJnhZG) [Click For All Sources](#action-item-✅) --- ## On My Radar 🎯 **Three cracks opened in Apple's privacy story this week** 1. Apple tells you that its Private Relay feature hides your IP address and your Safari browsing from network providers and websites. This is one of those situations where *technical privacy* doesn't always align with *practical privacy;* I'm a fan of the *tech* behind Private Relay because it distributes trust across more than one party and [even inspired more powerful VPNs like Obscura](https://techlore.tech/its-time-for-the-vpn-industry-to-innovate-obscura-interview/). But why does this matter when it turns out DNS prefetching was leaking your queries outside the Relay, as well as the WebTransport protocol, and the passkey system? Yep, the Mysk security team discovered these issues and they still aren't patched, meaning all of the situations I listed earlier can leak your IP even with Private Relay enabled. 2. Separately, the founders of EasyOptOuts found that Hide My Email was surfacing customers' real email addresses in bounce logs, all discovered accidentally while debugging why emails weren't arriving. They reported it to Apple, got nothing for months, then went to the press. It was patched a week later, on July 7th. 3. The third 'issue' to flag is Apple recently sent a wave of notifications to individuals targeted by state-sponsored spyware. If you received one of these notifications, check the sources down below for assistance. Apple continues to reassure users that Lockdown mode hasn't been bypassed, so it's something I'd encourage any security-conscious Apple user to implement. Regarding the Private Relay issue, what bothers me most is even a *properly functioning* Private Relay only ever covered Safari. Why isn't it system-wide? And why, in 2026, can no VPN on iOS: Mullvad, Obscura, IVPN, Windscribe, Proton, any of them—[*guarantee* that 100% of your traffic actually goes through the tunnel](https://mullvad.net/en/blog/force-all-app-traffic-into-the-tunnel) because of Apple's random exclusions? I wish I knew why Apple didn't treat IP-based protection seriously after years of researchers raising these concerns. **What you can do:** Hide My Email is fixed, but I'd still move to a dedicated aliasing service that gives you ownership, open source code, and isn't pinned to the Apple ecosystem. [SimpleLogin and Addy.io are two great tools](https://tools.techlore.tech/#aliasing-services) for this. And if Safari hiding your IP matters to you, **turn it off** and consider a [dedicated VPN ](https://vpn.techlore.tech/)in the meantime. Finally, don't forget to enable lockdown mode if you're concerned about nation-state threats. --- ## Bits & Bytes 🤖 **\~ Story 1: Big tech browsers are getting less private** 737 extensions impersonating ProtonVPN, NordVPN, Surfshark, ExpressVPN and Cloudflare's 1.1.1.1 were published to the **official** Chrome Web Store, routing traffic through a proxy. Google has pulled \~200, with over 500 still live at the time the article was written. Separately, AdGuard confirmed Edge is now phasing out Manifest V2, following Chrome. **My take:** Big tech's whole pitch is that their app stores are safe *because* they vet things. Then 500 impersonations sit there after the campaign was identified...*sigh*... I almost never install extensions, but when I do, I go to the developer's own website and use their download link. I recommend you *always* download software using official links from a verified source in this manner. As for MV2, Firefox has committed to support it indefinitely, Brave still ships an MV2 section in settings, and Vivaldi and the Firefox forks are fine too. Pretty much, if you're on a browser not run by a big tech company, you still get access to quality ad-blocking. I'll let you all decide if you think that's a coincidence and [choose your browser](https://tools.techlore.tech/#browsers) accordingly 😄 **\~ Story 2: Judge gives Google one week to fix its Play Store** [I covered recently](https://techlore.tech/signals-biggest-update-in-years-plus-rival-app-stores-arrive-in-the-play-store/) how following the Epic case, Google agreed to allow third-party app stores inside the Play Store, but the court found searching for Aptoide didn't return it properly, and the store page had a "View" button instead of "Install." The judge ordered both fixed within a week and Google's legal team agreed. **My take:** Winning the battle, losing the war. Yes, it's good. But Google is simultaneously making actual "sideloading" harder. Developer settings, a reboot, a 24-hour wait, a confirmation that you really meant it, all while *charging money* for third-party stores to get into the Play Store. What happens to people on custom ROMs who don't want the Play Store at all? That's the part nobody's targeting and can genuinely harm the Android ecosystem. **\~ Story 3: France's top court blocks the under-15 social media ban** A French top court found that the under-15 social media ban disproportionately infringed on freedom of expression and communication and failed to provide the safeguards needed to protect private life. Macron has asked his government to rewrite it. **My take:** This is a **huge win** but I don't want to oversell it. This isn't over in France, and the EU is still signaling it wants stronger protections for children from harmful social media features. To be clear: I want to see social media a healthier place for children, but I don't think *banning kids* is accomplishing that. Kids get around these bans, or their parents wave them through, or they wait until 16 and join the exact same exploitative platform, and nothing about the platform itself actually changed. Meanwhile, the only way to check anyone's age is to have everyone upload ID—to the very companies that keep getting breached! That's the *individual* being regulated instead of the *company,* all while making everyone less safe. So yes, amazing decision by this court in France, but I'm still hoping we see more activity that targets the *companies* responsible for this. --- ## This Week on Techlore 📺 Very busy week, so I'm excited to share some great things we worked on to make your digital rights journey a bit smoother 🙌 First, we launched *v2026.08* of our tools with new VPN pages, a smarter privacy quiz, and a much faster site to make them even stronger tools to use yourself or share with loved ones: [Techlore v2026.08: 100+ New VPN Pages, a Smarter Quiz, and a Faster SiteThis update brings 100+ new VPN pages you can browse without JavaScript, a smarter Quiz that stops recommending tools you already use, three new privacy tools, and a noticeably faster site across the board. Plus: a heads up on why v2026.09 might be late.![](https://storage.ghost.io/c/a2/66/a26623cd-de8a-40f5-bb97-cc1265613cf7/content/images/icon/tl-ee9916b1-2372-4dcc-b172-a82af076c808.png)TechloreHenry Fisher![](https://storage.ghost.io/c/a2/66/a26623cd-de8a-40f5-bb97-cc1265613cf7/content/images/thumbnail/Screenshot-2026-08-14-at-18.51.48-7fcde235-a7a1-4e54-93e4-32e1cf5b0f0c.png)](https://techlore.tech/techlore-v2026-08-100-new-vpn-pages-a-smarter-quiz-and-a-faster-site/) I had the privilege of speaking to the executive director of CalPrivacy to discuss California's DROP system, which opts people out of people-searching sites *for free,* and this interview reveals everything you need to know about the program and how it works: [Cory Doctorow’s Right About Data Brokers. He’s Wrong About DROP. Here’s Everything You Need to Know About California’s Opt-Out Tool.Cory Doctorow says California’s DROP tool is “privacy theater.” I was skeptical too, so I asked the executive director behind DROP. Welcome to my deep-dive on how DROP works and why I decided to start using it.![](https://storage.ghost.io/c/a2/66/a26623cd-de8a-40f5-bb97-cc1265613cf7/content/images/icon/tl-f63623ef-3dda-4152-859c-be9e962e2c52.png)TechloreHenry Fisher![](https://storage.ghost.io/c/a2/66/a26623cd-de8a-40f5-bb97-cc1265613cf7/content/images/thumbnail/maxresdefault-d31321b1-841d-4f11-8ffc-aabe8f53756e.jpg)](https://techlore.tech/cory-doctorows-right-about-data-brokers-hes-wrong-about-drop/) A recent tool went semi-viral called DecryptAds, so I wanted to share how it performs and shared other powerful ways you can analyze whether or not websites around the internet are spying on you: [How To Check What Any Website Is Doing With Your DataYou can look up exactly which companies are getting your data from any website for free, in about a minute. But the tool everyone’s sharing right now has a blind spot big enough that Facebook comes back completely clean. Here are three tools that actually show you what a![](https://storage.ghost.io/c/a2/66/a26623cd-de8a-40f5-bb97-cc1265613cf7/content/images/icon/tl-cabfcfa9-a415-46dd-aaf8-35716cabc15a.png)TechloreHenry Fisher![](https://storage.ghost.io/c/a2/66/a26623cd-de8a-40f5-bb97-cc1265613cf7/content/images/thumbnail/yourdoctor.com--3--e0d91afe-b5a7-4806-aeff-4bafed31d23f.png)](https://techlore.tech/how-to-check-what-any-website-is-doing-with-your-data/) Comcast released a new feature where they identify people using your home router. This was a creepy one and I had some advice to keep everyone's home network a bit safer: [Your ISP Is Watching You Walk Around Your HouseComcast just turned millions of leased Xfinity routers into motion sensors that track movement through your home, and buried in the fine print is a clause letting them hand that data to third parties without telling you. Here’s what Xfinity Shield actually does, why the tradeoff makes no sense![](https://storage.ghost.io/c/a2/66/a26623cd-de8a-40f5-bb97-cc1265613cf7/content/images/icon/tl-25c756df-36ff-4ff1-aff5-80da73ff40d9.png)TechloreHenry Fisher![](https://storage.ghost.io/c/a2/66/a26623cd-de8a-40f5-bb97-cc1265613cf7/content/images/thumbnail/Horror-Sonar-Ghost-Poster--3--6e0b5bce-ec2c-40bd-b198-2c683856e29b.png)](https://techlore.tech/your-isp-is-watching-you-walk-around-your-house/) And finally, I spoke with a member of DeFlock regarding the anti-ALPR movement and how anyone reading can get involved: [Flock No: The Open Source Project Mapping Every Surveillance Camera in America (DeFlock Interview)Techlore Talks brings you in-depth conversations with the experts at the forefront of digital rights, privacy and security.![](https://storage.ghost.io/c/a2/66/a26623cd-de8a-40f5-bb97-cc1265613cf7/content/images/icon/tl-544e4849-e70b-4ca3-98a7-eda87490a968.png)TechloreTori![](https://storage.ghost.io/c/a2/66/a26623cd-de8a-40f5-bb97-cc1265613cf7/content/images/thumbnail/20260822-BOB-DEFLOCK-INTERVIEW-thumbnail-v1-0e797244-bc1a-4a17-a185-8aa28baea054.jpg)](https://techlore.tech/flock-no-the-open-source-project-mapping-every-surveillance-camera-in-america-deflock-interview/) --- ## Action Item ✅ Two minutes on whatever Apple hardware you have. *Settings → iCloud → Private Relay*, and decide to live with its limitations, or replace it with a [full VPN](https://vpn.techlore.tech/). **Until next week 🫡** #### This Week's Sources ****Highlight:** - - - - ****Story 1: Your browser is quietly getting less private** - - ****Story 2: Judge gives Google one week to fix "anticompetitive" Play Store** - ****Story 3: France's top court blocks social media ban for under-15s** - ****The Defense Bulletin** **Data Breaches* - - - - - - - - - - - **Threats* - - - - - - - **FOSS+ Updates* - - - - - - - - - - - - -