Apple’s anonymous email feature isn’t nearly as anonymous as you might think

Apple’s Hide My Email feature has always been a pretty good quality-of-life privacy tool. iCloud+ subscribers can access randomly generated email addresses that forward messages to their real inbox. This helps users avoid any apps or websites from seeing their actual address. Apple also states that it doesn’t read the forwarded messages either.

All of this makes it quite a handy tool that genuinely cuts down on spam, creating a distance between you and whatever sketchy service wants your email.

But what it apparently does not do is hide your identity from law enforcement.

What’s going on?

According to court documents seen by TechCrunch, Apple provided federal agents with the real identities of at least two customers who had used Hide My Email addresses. One case in particular had the FBI seek records in an investigation that involved an email allegedly threatening Alexis Wilkins, who has been publicly reported as the girlfriend of FBI director Kash Patel.

The affidavit cited in the report states that Apple identified the anonymized address as being associated with the target Apple account. The company even provided the account holder’s full name and email address, along with records of another 134 anonymized email accounts created through this privacy feature.

TechCrunch also says it reviewed a second search warrant tied to an investigation by Homeland Security, where Apple again provided information linking Hide My Email accounts back to a user.

Why does this concern you

Before anyone starts calling out Apple for breaching privacy, they should know the distinction between companies and official warrants. Hide My Email is designed to protect users from apps, websites, and marketers, not from legal requests.

Apple still stores customer data like names, addresses, billing details, and other unencrypted info, which can be handed over when authorities come knocking with the right paperwork. So an email is a weak point here. Most emails are still not end-to-end encrypted, which means it is fundamentally different from services like Signal, whose popularity has grown precisely because of their robust privacy model.