iCloud Private Relay IP address website visitors: the B2B facts

Does iCloud Private Relay change the IP address website visitors show? Yes, but only for Safari users who pay for iCloud+ and have it switched on, and the one public measurement suggests that is a small share of traffic. Chrome's planned IP masking never reached first-party websites and was retired on 17 October 2025. For B2B teams using IP-based company identification, browser privacy features are a smaller factor than most headlines suggest.

Does iCloud Private Relay hide a visitor's IP from your website?

For the visitors who use it, yes. Apple describes Private Relay as "part of an iCloud+ subscription" that "helps protect your privacy when you browse the web in Safari".¹ Traffic passes through two relays. Apple explains that "Your IP address is visible to your network provider and to the first relay, which is operated by Apple", while "The second relay, which is operated by a third-party content provider, generates a temporary IP address".¹

Cloudflare, one of the second-relay operators, set out how that exit address is chosen in a 2022 post. It keeps "a pool of IP addresses for exclusive use by Private Relay", registered to cities around the world, and picks one close to the user's approximate location. The result is that websites see "an IP address that corresponds to the original user IP address's location, without obtaining information that may be used to identify the specific user."²

For a B2B website that means a Private Relay visit arrives from an address belonging to Apple's relay partner, in roughly the right region. It cannot resolve to the visitor's employer, because it was never on the employer's network.

Three limits keep the effect contained:

• It covers browsing in Safari, not every browser on the device.¹
• It requires a paid iCloud+ plan and the user must have it turned on.¹
• Apple notes it "is not available in all countries or regions".¹

How many visitors actually use Private Relay?

Fewer than the coverage implies, as far as public data shows. The only large measurement we could find is Pixalate's study of over 70 billion ad transactions in the United States between 15 May and 15 August 2022. It found about 21% of traffic "purported to come from Apple Devices on both mobile and desktop Safari" claimed to come from Private Relay. But only "around 1%-2% of traffic from purported Apple devices was detected as originating from an iCloud Private Relay IP and exhibiting the expected behavior".³ Pixalate concluded that most of the gap was likely invalid traffic claiming Private Relay status.

Two caveats matter. The study is from 2022, measured US advertising traffic rather than UK business websites, and we have not found a newer public measurement. So treat 1 to 2% as an indication that genuine use was modest at the time, not as a current UK figure.

What happened to Chrome's IP Protection?

It was announced, narrowed and then retired. The important detail for website owners is that it was never designed to hide visitors' IP addresses from the sites they visit.

Google's GitHub explainer described IP Protection as "a feature that limits availability of a user's original IP address in third party contexts in Incognito mode".⁴ Google's documentation was explicit that it "will not apply in a first-party context", meaning when the resource's domain matches the site in the address bar.⁵ In other words, even at its most ambitious it targeted third-party trackers embedded in pages, not the site a person was reading.

On 22 April 2025 Google said it planned to launch IP Protection in the third quarter of 2025 as part of Incognito's tracking protections.⁶ Then, on 17 October 2025, Google's VP for Privacy Sandbox, Anthony Chavez, wrote that "After evaluating ecosystem feedback about their expected value and in light of their low levels of adoption, we've decided to retire" a list of Privacy Sandbox technologies that included IP Protection, alongside Topics, Protected Audience and the Attribution Reporting API.⁷ Trade coverage at the time noted that CHIPS, FedCM and Private State Tokens were the pieces that survived.⁸ The GitHub repository for IP Protection was archived on 3 November 2025.⁴

As of 27 September 2026 we have found no announced plan from Google to bring IP Protection back. Chrome passes a visitor's real IP address to the website they are visiting, as it always has. Some third-party articles still describe IP Protection as arriving in 2026. The primary sources above say otherwise.

And third-party cookies?

Chrome kept them. On 22 July 2024 Google dropped its plan to remove third-party cookies and proposed instead "a new experience in Chrome that lets people make an informed choice that applies across their web browsing".⁹ On 22 April 2025 it went further and said it "will not be rolling out a new standalone prompt for third-party cookies", leaving the controls in Chrome's existing privacy settings.⁶

None of this affects IP-based company identification, which never relied on third-party cookies. Identification works from the network address a visit arrives from, read by a first-party script on your own site. If you have read that "cookies are dead, so visitor identification is dead", the two things were never connected. The data protection side is covered in our guide to visitor identification and UK GDPR.

What does still erode IP matching?

The bigger factors are changes in where and how people work, not browser features:

Private Relay sits at the bottom of that table for a reason. It affects one browser, on a paid plan, for people who chose to switch it on. Hybrid work and mobile browsing affect almost every B2B audience, every day, whatever browser people use. If a tool's results look thin, those are the first places to look.

We look at the first two with UK figures in why match rates fall: remote work, IPv6 and CGNAT. For the underlying method, see the guide to website visitor identification.

How should a visitor identification tool respond?

Honestly, by saying when it cannot know. A relay, VPN or data-centre exit address is not the visitor's company, and a tool that names a company anyway produces a false positive that someone in sales may act on. The sensible response has three parts:

1. Classify the network. Recognise consumer ISP, mobile, VPN and hosting ranges and label them as such.
2. Cap their confidence. A visit from one of those networks should never look as certain as a match from a company's own office network.
3. Lean on other signals. Return visits from a corporate network, pages read and the search queries that brought a company to the site all help judge the visits that can be identified.

That is how Scout works. Every identified company gets a confidence score from 1 to 99 with a band and a one-line reason, and ISP, residential, mobile, VPN and data-centre traffic is flagged and held in the low band rather than dressed up as a company. Connecting Google Analytics 4 and Google Search Console adds session depth, pages read and associated search queries to each company.

The practical answer

Private Relay hides the real IP for a subset of Safari users. Chrome's IP Protection was aimed at third-party trackers, never reached first-party sites and was retired in October 2025. Chrome also kept third-party cookies, which identification never used. The factors worth planning for are hybrid work and mobile networks, and the tool worth choosing is one that tells you how sure it is.

Scout flags VPN, mobile and data-centre traffic instead of guessing. Try it free for 14 days, or see how plans are measured on the pricing page.

Frequently asked questions

Does iCloud Private Relay affect Google Analytics?

It can affect location data for the Safari users who have it switched on, because the site sees a relay address rather than the visitor's own. Cloudflare says the relay address is chosen to correspond to the user's approximate location, so broad regional reports should still be roughly right while fine-grained location will not be.

Is Chrome IP Protection coming back?

As of 27 September 2026 Google has announced no plan to bring it back. Google listed IP Protection among the Privacy Sandbox technologies it retired on 17 October 2025, and the project's GitHub repository was archived on 3 November 2025.

Should I worry about Firefox or Brave?

The question to ask of any browser feature is whether it routes traffic through a proxy or VPN, because only that changes the IP address your website sees. Features that block trackers or cookies do not change the address of a first-party visit. Check each browser's own documentation for proxy or VPN features and how widely they are used.

Can a visitor identification tool see through Private Relay?

No, and it should not claim to. A Private Relay visit exits from an address belonging to Apple's relay partner, not the visitor's employer. A responsible tool labels that kind of traffic and keeps its confidence low rather than naming a company.

Sources

1. Apple Support: About iCloud Private Relay support.apple.com
2. Cloudflare Blog: iCloud Private Relay blog.cloudflare.com
3. Pixalate: iCloud Private Relay ad fraud study pixalate.com
4. GitHub: GoogleChrome/ip-protection github.com
5. Google Privacy Sandbox: IP Protection overview privacysandbox.google.com
6. Google Privacy Sandbox: Next steps for Privacy Sandbox and tracking protections in Chrome privacysandbox.google.com
7. Google Privacy Sandbox: Update on plans for Privacy Sandbox technologies privacysandbox.google.com
8. PPC Land: Chrome kills most Privacy Sandbox technologies after adoption fails ppc.land
9. Google Privacy Sandbox: A new path for Privacy Sandbox on the web privacysandbox.google.com