iCloud Private Relay vs VPN: What Each One Actually Hides

Quick answer: iCloud Private Relay is an iCloud+ feature that hides your IP address and Safari browsing by sending them through two separate relays. It also covers DNS lookups and unencrypted app traffic, but not the rest of your apps, and it can’t place you in another country. A VPN covers all of your device’s traffic and lets you pick a region, so it covers what Private Relay leaves out.

The rest of this guide covers what Private Relay protects and what it skips, how to turn it on or off on iPhone and Mac, and how it behaves alongside a VPN.

What iCloud Private Relay is

Private Relay comes with iCloud+, the paid tier of iCloud. If you or someone in your Family Sharing group subscribes, you can turn it on for your iPhone, iPad, and Mac. It’s built into the operating system, so there’s no app to install.

According to Apple’s Private Relay overview, it protects three kinds of traffic:

• Safari browsing, all of it.
• DNS lookups, the “where is this website?” queries your device sends before it connects to a site.
• Unencrypted traffic from apps, meaning plain HTTP connections. Most apps today use encrypted connections, so this is a small share of what they send.

The design is the interesting part. Your traffic passes through two relays. The first is run by Apple. It sees your IP address, but the name of the site you’re visiting is encrypted, so it doesn’t know where you’re going. The second is run by a third-party content provider. It decrypts the site name, gives you a temporary IP address, and makes the connection, but it never sees your real address. No single party sees both who you are and what you’re browsing.

The address websites see belongs to your region. Under IP Address Location you can choose Maintain General Location, which keeps local content like weather and search results accurate, or Use Country and Time Zone, which picks an address from a much wider area.

What Private Relay doesn’t cover

Private Relay is narrower than a VPN, and each gap matters in a different situation:

• Most traffic from your other apps. Messaging and banking apps, games, streaming apps, and other browsers like Chrome connect directly over their own encrypted connections. The servers they talk to still see your real IP address, and your network can still see which servers they reach.
• Choosing a country. Apple says plainly that Private Relay doesn’t let you appear to connect from a different country or region. It isn’t a tool for travel or region testing.
• Some countries and regions. Private Relay isn’t offered everywhere. Apple’s feature availability list currently leaves out places including China mainland, Russia, Saudi Arabia, Türkiye, and the United Arab Emirates. When you travel somewhere it isn’t available, it switches off automatically and comes back when you return.
• Networks that block it. Business, school, and parental-control networks that audit or filter traffic may not support it. You’ll see a message saying the network isn’t compatible, and the fix is to turn it off for that network.

Some websites also ask for extra steps, like a CAPTCHA or a second sign-in check, because they can’t see your real address. Speed tests can read lower than usual too, since Private Relay sends everything over one connection.

How to turn Private Relay on or off on iPhone

These steps follow Apple’s current iPhone guide to Private Relay.

1. Open Settings and tap your name at the top.
2. Tap iCloud, then Private Relay.
3. Turn on Private Relay.

To turn it off, go back to the same screen and turn it off, then choose Turn Off Until Tomorrow, which switches it back on within 24 hours, or Turn Off Private Relay to leave it off.

You can also turn it off in a narrower way:

• For one Wi-Fi network: go to Settings > Wi-Fi, tap the More Info button next to the network, and turn off Limit IP Address Tracking. This turns Private Relay off for that network on every device signed in to your Apple Account.
• For cellular: go to Settings > Cellular, tap Cellular Data Options (or pick your line under SIMs if you have more than one), and turn off Limit IP Address Tracking.
• For one website: in Safari, tap the button on the left side of the search field, tap Privacy & Security, then Show IP Address. The site sees your real address until you leave it or close the tab.

Private Relay has to be turned on separately on each device.

How to turn Private Relay on or off on Mac

1. Open System Settings and click your name at the top of the sidebar.
2. Click iCloud, then Private Relay.
3. Turn on Private Relay, then click Done.

To turn it off, use the same switch and choose Turn Off Until Tomorrow or Turn Off Private Relay. For one network, go to System Settings > Network, click Wi-Fi, click Details next to the network, and turn off Limit IP address tracking. For one site, use View > Reload and Show IP Address in Safari. Apple’s article on managing Private Relay for websites and networks covers every per-site and per-network option.

Private Relay vs VPN at a glance

	iCloud Private Relay	VPN
Traffic covered	Safari, DNS lookups, unencrypted app traffic	Usually all traffic from the device
Hides your IP from	Websites you visit in Safari	Websites and services, in every app it covers
Choose a country	No, you stay in your own region	Yes, by picking a server location
Who sees what	Split across two relays; neither sees everything	The VPN provider sees your IP and where you connect
Devices	Apple devices only	Depends on the provider; often Android and Windows too
Where it works	Not offered in some countries; some networks block it	Most places; some networks block VPNs too
What you need	An iCloud+ subscription	A VPN app and subscription

The “who sees what” row is the honest trade-off. Private Relay’s two-relay design means even Apple can’t see both halves. A VPN sends everything through one provider, so you’re trusting that provider with what your internet provider used to see. Our explainer on what a VPN actually hides walks through that trust shift in detail.

When to use which

Private Relay alone is enough when you mostly browse in Safari on Apple devices, you already pay for iCloud+, and your goal is to stop websites and your network provider from building a profile from your IP address and browsing history. Leave it on and forget about it.

A VPN is the better tool when:

• You’re on public Wi-Fi and want every app covered, not just Safari. The public Wi-Fi checklist explains why that’s still worth doing in the HTTPS era.
• You need to appear in another region, for example to check how a site looks from another country. Private Relay can’t do that by design.
• You use Chrome, Firefox, or other non-Safari apps for most of your browsing.
• You have non-Apple devices that need the same protection.
• Private Relay isn’t available where you live or travel.

BlueHammer VPN encrypts your connection and hides your IP address across your apps, and one purchase covers iOS, Android, and macOS. The same subscription also includes BlueHammer Security, Drive, and Cleaner. For the day-to-day moments when a VPN earns its place, see when to use a VPN on Mac.

Can you use Private Relay and a VPN together?

You can leave both switched on, but you don’t get two layers. Apple’s overview is direct about it: if a device has a VPN installed, traffic that goes through the VPN doesn’t use Private Relay, and a proxy setup takes priority in the same way.

In practice, that works out neatly on iPhone:

• VPN connected: the VPN carries your traffic, including Safari.
• VPN disconnected: Safari goes back through Private Relay as usual.

So a sensible setup is to keep Private Relay on as your everyday Safari default and switch the VPN on when you need whole-device coverage or a different region.

On a Mac it can be less tidy. Some VPN and content-filtering apps install settings that conflict with Private Relay, and System Settings shows an alert saying Private Relay is being blocked. Apple’s advice is to turn off or uninstall that app if you want Private Relay. If you’d rather keep the VPN app, expect Private Relay not to work on that Mac, and connect the VPN whenever you want your traffic covered. If your VPN is the thing misbehaving, our guide to a VPN not working on iPhone covers the usual fixes. For the other IP-related switches in Settings, see every iPhone privacy setting for your IP address.

Honest limits of both

Neither tool makes you anonymous. The moment you sign in to an account, that service knows who you are, whatever IP address it sees. Cookies and browser fingerprinting track you without needing your IP at all, and neither Private Relay nor a VPN stops a phishing page from loading.

What each tool does well is narrower and still worth having. Private Relay keeps your Safari browsing out of your network provider’s view and your real address away from websites, with almost no effort. A VPN does the same for every app, on any network, in whatever region you need. Pick the one that matches the gap you’re trying to close, and keep your sign-in and link habits sharp for everything they don’t cover.