Wondering whether iCloud Private Relay vs VPN on iPhone and Mac is the right choice for you? This guide shows you how to turn on Private Relay, check its network settings, and understand which traffic it protects. The steps cover an iPhone running iOS 27 and a Mac running macOS 27 Golden Gate.
What Is iCloud Private Relay?
Private Relay is an iCloud+ feature designed to protect your browsing activity in Safari. It also protects Domain Name System (DNS) queries and insecure (unencrypted HTTP) traffic from apps, according to Apple’s developer overview of Private Relay. That app coverage is narrow: the encrypted connections most apps use are not sent through Private Relay, so it is not a substitute for routing an app through a VPN.
When protected traffic uses Private Relay, it passes through two relays. Apple’s relay can see your original internet protocol (IP) address but not the website you request. A second relay can see the website request but not your original IP address. This limits how much either relay can learn on its own. It does not make you anonymous to a website where you sign in.
iCloud Private Relay vs VPN on iPhone and Mac: Which Should You Choose?
| What you need | Private Relay | VPN |
|---|---|---|
| More privacy while browsing in Safari | Built for this, with iCloud+ | Depends on the VPN’s routing rules |
| Routing for other browsers and apps | Protects DNS queries and insecure HTTP app traffic, but not all app connections | May cover them, depending on its configuration |
| An IP address in a country you choose | No arbitrary country picker | Some services offer country selection |
| Access to a workplace network | Does not replace a workplace VPN | Use the VPN supplied by your workplace |
A VPN’s coverage depends on how it is set up. A full tunnel generally sends traffic through the VPN, while a split tunnel sends only selected traffic through it. A per-app VPN applies to designated apps. Even a VPN described as full tunnel can have exceptions, so check the provider’s or your workplace’s settings. The VPN provider is also a party you must trust with the traffic it handles.
Before You Begin
- Use an iPhone running iOS 15 or later, or a Mac running macOS Monterey 12 or later. The paths below are written for iOS 27 and macOS 27 Golden Gate.
- Sign in to your Apple Account on each device.
- Have an active iCloud+ subscription, including one shared with you through Family Sharing.
- Check that Private Relay is available in your country or region. Apple lists availability and restrictions.
- Connect to Wi-Fi or cellular data. Some networks and third-party networking apps may interfere with Private Relay.
On iPhone, check your installed version in Settings > General > About. On Mac, open the Apple menu > About This Mac.
There is no app to download or Terminal command to run. Private Relay is built into supported Apple software.
Step-by-Step Guide
On iPhone running iOS 27
Step 1: Check your iCloud+ access
Open Settings and tap [your name]. If your name is not at the top, sign in to your Apple Account. Tap iCloud and look for your iCloud+ plan or subscription details.
Expected result: Your account shows an active iCloud+ plan, or access shared through Family Sharing. If you need to subscribe, follow the iCloud+ prompts shown in Settings.
Step 2: Open Private Relay
Go to Settings > [your name] > iCloud > Private Relay.
Expected result: You see the Private Relay control and, when available, IP Address Location. If Private Relay is missing or unavailable, check the troubleshooting section below.
Step 3: Turn on Private Relay
Turn on Private Relay. If iOS asks you to confirm, follow the prompt. You must enable the feature separately on each device where you want to use it.
Expected result: Private Relay appears on in its settings page. This confirms the device setting; a network or app restriction can still affect whether it works on a particular connection.
Step 4: Choose your IP address location
Tap IP Address Location. Choose Maintain General Location if you want websites to receive an approximate location near you, which can help with local content. Choose Use Country and Time Zone if you prefer a broader location.
Expected result: Your chosen option is selected. Use Country and Time Zone does not let you pick a different country.
Step 5: Check the connected Wi-Fi network
Go to Settings > Wi-Fi. Tap the information button beside the connected network, then find Limit IP Address Tracking. Leave it on if you want Private Relay available on that network.
Expected result: The network’s control shows whether IP address tracking is limited for that connection. Turning it off makes an exception for this Wi-Fi network, and Apple notes that the exception applies to that network on all your devices signed in to the same Apple Account. This per-network switch is separate from the main Private Relay switch and from Turn Off Until Tomorrow, which pause Private Relay on the device everywhere.
If you mostly use mobile data, check the cellular control too. Go to Settings > Cellular and tap Cellular Data Options (or, with more than one line, select the line under SIMs), then find Limit IP Address Tracking. This setting is specific to that physical SIM or eSIM.
On Mac running macOS 27 Golden Gate
Step 6: Check your iCloud+ access
Open the Apple menu > System Settings and click [your name]. Sign in if needed. Click iCloud and check that your account has iCloud+ access.
Expected result: Your iCloud settings show your subscription or shared iCloud+ access.
Step 7: Open Private Relay
Go to Apple menu > System Settings > [your name] > iCloud > Private Relay.
Expected result: The Private Relay pane opens with its device setting and location options.
Step 8: Turn on Private Relay
Turn on Private Relay, then click Done if the pane presents that button.
Expected result: The setting appears on when you return to the Private Relay pane.
Step 9: Choose your IP address location
Open IP Address Location in the Private Relay pane. Select Maintain general location for an approximate local area, or Use country and time zone for a broader location. Click Done if prompted.
Expected result: Your selected location behavior is shown. Private Relay cannot make you appear to be in a country you choose.
Step 10: Check the connected Wi-Fi network
Go to Apple menu > System Settings > Network > Wi-Fi. Click Details beside the connected network and find Limit IP address tracking. Leave it on if you want Private Relay available on that network.
Expected result: You can see whether the connection allows Private Relay’s IP address protection. Turning this control off makes an exception for that network.
On a wired connection, go to System Settings > Network, click the name of your Ethernet connection, then click Advanced to find Limit IP address tracking.
Configuration: Choose the Setting That Fits
Private Relay’s two location choices change how closely its relay IP address reflects your location. Neither choice provides a country selector. If selecting a specific country matters, look for a VPN service that offers the location and check its privacy policy before signing up.
For everyday Safari browsing, Private Relay is a convenient option if you already pay for iCloud+. If you need another browser’s traffic routed, have requirements for specific apps, or need access to a workplace network, check the VPN’s configuration. A workplace may require its own VPN app and may manage which apps or destinations use that connection.
You can use Private Relay on one device and a VPN on another, or have both enabled on the same device. Do not assume their protections stack for each connection. Traffic handled by a VPN or network extension may bypass Private Relay, take precedence over it, or interfere with it. Apple explains these network interactions for administrators. For a work device, follow your organization’s VPN instructions.
Before choosing, ask yourself:
- Is my main goal more privacy while using Safari?
- Do I need another browser or particular apps routed through a VPN?
- Do I need a country-specific exit location?
- Does my workplace require its own VPN or network filter?
- Have I checked the controls on the device and network I actually use?
Tips and Troubleshooting
Private Relay is unavailable or will not turn on
Why it happens: Your iCloud+ subscription may be inactive, Private Relay may be unavailable in your region, or a network or third-party app may block it.
Fix: Confirm iCloud+ under Settings > [your name] > iCloud on iPhone, or System Settings > [your name] > iCloud on Mac. Check the connected network’s Limit IP Address Tracking or Limit IP address tracking control. If you use a VPN or network-filtering app, review its settings and Apple’s troubleshooting guidance. On Mac, Apple may advise turning off or uninstalling an interfering third-party app if you want Private Relay to work.
One website asks for extra verification or shows the wrong local content
Why it happens: The website may rely on the IP address or approximate location it sees.
Fix: First try Maintain General Location or Maintain general location under IP Address Location. If the site still has trouble, return to the device’s Private Relay settings and use Turn Off Until Tomorrow if that option is offered. This pauses Private Relay beyond that one site, so turn it back on afterward if you finish sooner.
Private Relay works on one Wi-Fi network but not another
Why it happens: A network can restrict or interfere with Private Relay.
Fix: Check Settings > Wi-Fi > information button > Limit IP Address Tracking on iPhone, or System Settings > Network > Wi-Fi > Details > Limit IP address tracking on Mac. If the network requires an exception to connect or use a service, turn the control off for that network and try again. Your traffic on that connection will have less Private Relay protection.
An app outside Safari still shows your usual IP address
Why it happens: Private Relay is not a whole-device VPN. Its documented scope includes Safari browsing, DNS queries, and insecure HTTP app traffic, but it does not cover every app connection.
Fix: If that app needs VPN routing, check whether your VPN uses a full tunnel, split tunnel, or per-app rules. A VPN’s connected icon alone does not establish that every app uses it.
Private Relay changes behavior when you connect a VPN
Why it happens: VPN and network-filtering rules can change the route taken by traffic that Private Relay would otherwise protect.
Fix: Check the VPN app’s routing options or ask your workplace administrator which traffic its VPN handles. Use the workplace VPN when access to work resources requires it. Do not count on both services protecting the same request at once.
Wrapping Up
You can now turn on Private Relay on your iPhone or Mac, choose its location behavior, and check whether a Wi-Fi network allows it. For Safari browsing, it is a useful benefit of iCloud+; for work access or broader app routing, a properly configured VPN may be the better fit.
| Step | Action | Applies To |
|---|---|---|
| 1–5 | Check iCloud+, enable Private Relay, and review location and Wi-Fi settings | iPhone |
| 6–10 | Check iCloud+, enable Private Relay, and review location and Wi-Fi settings | Mac |