# iCloud Private Relay

iCloud Private Relay is Apple's two-hop relay for Safari and iCloud+ subscribers; a site sees an Apple egress address with a coarse location, never the subscriber's own.

Date: 2026-09-12

iCloud Private Relay is the privacy service Apple switches on for iCloud+ subscribers in Safari: traffic passes through two hops, one run by Apple that knows the subscriber and one run by a partner that knows the destination, so neither sees both. A website sees the second hop's address — an egress address Apple publishes in a list with the coarse city or region it stands for — and never the subscriber's own.

## What Spaw answers

`is_relay` is true on an address from Apple's published egress list, `privacy_service` reads `iCloud Private Relay`, and the operator-declared location from that list wins over the database with `location_source: operator`. The weight is +10, the smallest of the anonymity signals, because Private Relay is on by default for a paying subscriber and says almost nothing about intent; the datacenter weight is skipped for relay egress, since it sits on infrastructure by design. Apple's egress ranges also appear in the aggregate VPN list, so `is_vpn` answers false on them unless a VPN provider's own list names the address — the first-party declaration outranks the aggregate classification.

## What it does not mean

A relay address is not a VPN in the sense fraud teams mean: there is no server to pick, no country to choose, and the location Apple publishes is honest to the region. Treating +10 as a block would refuse a large share of iPhone users for no signal at all.

Reference: https://spaw.co/glossary/icloud-private-relay