Apple Makes Hide My Email Easier to Block: Why Privacy Tools Keep Becoming an Arms Race

Apple's Hide My Email lets you sign up for things with a throwaway address instead of your real one — a small but genuinely useful privacy tool. Now Apple is changing how those addresses are formatted in a way that makes them easier for websites to spot and block. It is a neat illustration of why privacy tools so often turn into a tug-of-war.

What Hide My Email does and why people like it

Hide My Email is part of iCloud+ (Apple's paid iCloud tier) and is also built into Sign in with Apple. When you use it, Apple generates a random, anonymous email address that forwards everything to your real inbox. The website sees the alias; your actual address stays hidden. If a site later spams you or gets breached, you simply switch off that one alias — your real inbox is untouched.

The reason it has worked so well, as TechCrunch and MacRumors explain, is camouflage. Today those aliases use the ordinary @icloud.com domain — the same domain millions of regular Apple users have on their everyday addresses. A website cannot tell an anonymous Hide My Email address apart from a normal iCloud user just by looking at the domain.

What Apple is changing

According to a developer note reported by MacRumors, TechCrunch and Cybernews, Apple plans to move its anonymously generated addresses to a dedicated @private.icloud.com subdomain, unifying the domains used by Sign in with Apple and iCloud+ Hide My Email under that one private label later this summer.

That sounds like tidy housekeeping, and in part it is. But it has a side effect: once every alias ends in @private.icloud.com, any website can write a one-line rule that says "reject sign-ups from this domain." The very feature that made Hide My Email effective — being indistinguishable from a normal address — is exactly what the new naming removes. Apple has said existing addresses will keep working and forwarding without interruption; the concern is about how new sign-ups will be treated going forward.

Why this is an arms race, not a one-off

Step back and the pattern is familiar. A privacy tool gives users an edge; the businesses on the other side build a counter; users (or the tool's makers) adapt again. Hide My Email is just the latest round:

• Email aliasing hid your real address — so services started blocking known alias domains (services like masked-email providers have faced this for years). Apple's change hands websites an easy way to do the same to Apple aliases.
• Tracking pixels in emails watched whether you opened a message — so Apple's Mail Privacy Protection pre-loads images to hide your open behavior.
• Ad and cross-site tracking followed you around — so browsers added tracking prevention, and trackers responded with fingerprinting and server-side workarounds.

Why do companies push back on aliases at all? Some have legitimate reasons — anonymous addresses are used for fake accounts, trial abuse and fraud, so anti-abuse teams want to detect them. Others simply want a real, marketable email address. Either way, the user caught in the middle is the person who just wanted to sign up for a newsletter without handing over their primary inbox.

What it means for you, practically

If you rely on Hide My Email, here is the measured take — no alarm needed:

• Your existing aliases keep working. Apple says current addresses continue to forward mail. You do not need to do anything urgent.
• Some sites may start refusing new aliases. Once the @private.icloud.com domain is in use, expect the occasional sign-up form to reject it. That is the realistic downside.
• Keep a fallback. For the rare site that blocks aliases, it is worth having a secondary "junk" email address you control, or a different aliasing service, so you are not forced to surrender your primary inbox.
• The privacy benefit is not gone — just less stealthy. Hide My Email still shields your real address and still lets you kill a misbehaving alias. What it loses is the ability to slip past sites that specifically don't want anonymous sign-ups.

A note on what this change is not: it does not expose your real email to sites that already have an alias, and it does not stop the forwarding. The trade-off is narrower than the headlines suggest — convenience and stealth at sign-up, not your existing privacy.

How to use AI assistants safely without sharing too much

FAQ

Will my current Hide My Email addresses stop working?

No. Apple says existing addresses will continue to function and forward mail without interruption. The change affects how addresses are labeled going forward.

Why would a website block a Hide My Email address?

Mostly anti-abuse: anonymous aliases are used for fake accounts and trial abuse, so some sites reject them. Others simply want a "real" marketable address. The new @private.icloud.com domain makes those addresses trivial to identify.

Is Hide My Email still worth using?

Yes for most people. It still hides your real inbox and lets you disable a single alias if a site spams you or gets breached. You just may hit the occasional site that won't accept it.

What can I do if a site rejects my alias?

Keep a secondary email you control as a fallback for those cases, rather than giving up your primary address. You can also use a different masked-email service, though those face the same blocking pressure.

Bottom line

Apple's switch to @private.icloud.com is a small formatting change with an outsized symbolic point: a privacy feature works best when it is invisible, and labeling it makes it blockable. Hide My Email remains useful, your current aliases are safe, but the episode is a clean reminder that privacy online is rarely "solved" — it is negotiated, round after round.

Sources and further reading