Apple gives Hide My Email a label that says 'block me'

A privacy feature that worked because it was invisible

Hide My Email's quiet superpower was plausible deniability. An alias arrived as [email protected], indistinguishable from a paying iCloud user, so any site that blocked it risked blocking real customers too. That cost is what kept the feature usable.

The author's post lays out the change announced June 15, 2026: both Sign in with Apple and Hide My Email aliases are migrating to the @private.icloud.com subdomain. He calls it "a big hit for iCloud privacy." The mechanics are simple and that is the problem. A service no longer has to guess which addresses are relays; it can reject everything from one subdomain in a single rule, the same way it already blocks throwaway-email providers. His recommended hedge: pre-generate spare @icloud.com aliases now, while the old domain still works, at a rate limit he puts at "at least 30 per hour."

"What am I missing?" — the question that exposed the trick

Not everyone saw the threat immediately. The top voice in the thread asked the obvious question:

"Could someone clarify why having Sign in with Apple and Hide My Email on the same domain would make a blanket ban easier rather than harder? What am I missing?" — a product designer

The answer is separation, not combination: the new subdomain peels relay traffic away from ordinary @icloud.com mail, so blocking it no longer hits genuine mailboxes. One longtime user logged the loss in concrete terms:

"It's actually useful compared to Gmail's useless 'yourrealaddress+alias' that gives away your actual email anyway, and it helped me catch quite a few spammers/data sellers." — a developer who uses aliases to trap data sellers

The self-defeating ban

The sharpest counter cut against the alarm. Banning the relay domain isn't free for the site either:

"Okay but banning private relay emails would also mean your site is blocking Apple sign in?" — a commenter who likes computers

And another noted Apple's App Store rules may already forbid it: apps are required to support Sign in with Apple, so breaking it could get an app pulled. The rule that emerges is narrower than the headline: a site can now cheaply reject Hide My Email at signup, but only by accepting the same friction it was told to avoid. The privacy guarantee didn't vanish; Apple just moved it from "impossible to target" to "costly to target," and handed the bill to whoever clicks block.