If you pay for iCloud+, you already have something that looks a lot like a VPN. Flip on iCloud Private Relay and Safari stops showing websites your real IP address. So why would anyone with an iPhone pay for a VPN on top?
Because Private Relay and a VPN solve different problems. One protects your browsing from trackers. The other protects your whole connection and lets you choose where you appear to be. Here’s the practical difference, with no Apple marketing and no VPN marketing either.
What iCloud Private Relay actually does
Private Relay is part of the iCloud+ subscription. When it’s on, your Safari traffic goes through two separate relays before it reaches a website.
The first relay is run by Apple. It sees your real IP address, but your DNS queries are encrypted, so it can’t see which site you’re visiting. The second relay is run by a third-party content provider. It gives you a temporary IP address, decrypts the site name and connects you. Apple’s pitch, in its own support page, is that “no single party, not even Apple, can see both who you are and what sites you’re visiting.”
That design is genuinely clever. A normal VPN is one company that sees both ends. With Private Relay, two companies each see half.
According to Apple’s technical overview, Private Relay covers three things:
- browsing in Safari
- DNS lookups from the device
- unencrypted (plain HTTP) traffic from apps
That last point is narrower than it sounds. Almost every modern app talks to its servers over HTTPS, so most of your app traffic never goes through Private Relay at all.
What a VPN does differently
A VPN creates one encrypted tunnel for everything your device sends: every browser, every app, every background sync, games, calls, email. Your internet provider sees an encrypted stream going to a VPN server and nothing else. Websites and apps see the VPN server’s IP address.
And you pick the server. Want a UK IP address to watch BBC iPlayer on holiday, or a US one to check American prices? A VPN does that. Private Relay can’t.
Private Relay vs VPN: side by side
| iCloud Private Relay | Paid VPN | |
|---|---|---|
| Covers Safari | Yes | Yes |
| Covers other browsers (Chrome, Firefox) | No | Yes |
| Covers app traffic | Only unencrypted HTTP | Yes, all of it |
| Hides your IP from websites | Yes | Yes |
| Hides your activity from your ISP | Safari and DNS only | Yes, all traffic |
| Choose your country | No | Yes |
| Unblock streaming catalogues | No | Yes, depending on the VPN |
| Works on Windows and Android | No, Apple devices only | Yes |
| Two-party design | Yes | No, one provider |
| Price | Included with iCloud+ | Roughly $3 to $6 a month on long plans |
The big limitation: you can’t choose your location
Private Relay gives you two settings for your IP address, and both keep you in your own country. “Maintain general location” maps you to a roughly city-sized area near where you are, so sites can still show local content. “Use country and time zone” is broader, but Apple’s documentation is clear that it still maps to your original country and time zone.
That’s deliberate. Apple doesn’t want Private Relay used to dodge geo-blocking, and it doesn’t want Netflix or the BBC angry at it. So if you’re travelling and want your home streaming services, or if you want to look like you’re in another country for any reason, Private Relay won’t help.
Private Relay turns off when your VPN is on
This trips people up. When a VPN is active on your iPhone or Mac, its traffic does not go through Private Relay. Apple’s overview states that a VPN, whether personal or enterprise, “takes precedence.” The same goes for a configured proxy.
So there’s no point trying to stack them for extra privacy. You choose one or the other per connection. Leaving Private Relay enabled in settings is harmless: it simply sits out while the VPN runs and comes back when you disconnect.
Where Private Relay is actually better
It’s not all one-way. Private Relay has real advantages.
No single company sees everything. With a VPN, you’re trusting one provider not to log your activity. That’s why we score VPNs on audited no-logs policies, jurisdiction and RAM-only servers. Private Relay’s split design removes that single point of trust for Safari browsing.
It’s free if you already pay for iCloud+. If your goal is simply to stop websites and ad networks tracking your IP address while you browse in Safari, you may not need anything else.
It’s set-and-forget. No app, no server list, no disconnects. It runs quietly in the background.
Where a VPN is clearly better
Public Wi-Fi. On a hotel or café network, Private Relay protects Safari and DNS. A VPN protects everything, including the banking app, the email client and the messaging app that’s busy syncing in the background. Our public Wi-Fi safety guide explains why that matters more on shared networks.
Non-Apple devices. Private Relay only exists on iPhone, iPad and Mac. A VPN subscription covers your Windows laptop, Android tablet and smart TV too.
Other browsers. If you use Chrome or Firefox on your Mac, Private Relay does nothing for them.
Location and streaming. Choosing your country is the main reason many people buy a VPN, and Private Relay simply doesn’t do it.
Networks that block it. Apple’s own documentation explains that networks can block Private Relay by refusing to resolve its relay hostnames. Some schools, offices and mobile carriers do exactly that. Many VPNs have obfuscation modes for that situation.
Which VPNs work best on Apple devices?
If you decide you need a VPN, pick one that also takes privacy seriously, otherwise you’ve swapped Apple’s two-party design for a single provider you know nothing about.
In our database, NordVPN leads overall at 4.63/5, with a PwC-audited no-logs policy, RAM-only servers and Excellent results on Netflix, Disney+ and BBC iPlayer. The 1-year plan is $68.85 (about $5.74 a month). Try NordVPN with its 60-day money-back guarantee.
Proton VPN scores 4.24/5 and is the better match if privacy is your main reason: Swiss jurisdiction (5/5), a KPMG-audited no-logs policy, and $47.88 for a year (about $3.99 a month). It also has a free plan if you just want to try a VPN alongside iCloud+.
Mullvad (4.04/5) is the pick for people who want an account with no email and no name at all. It’s weak on streaming, though.
Setting one up takes two minutes. Our iPhone VPN setup guide walks through it step by step, and our best VPN for Mac roundup covers desktop picks.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
So, do you need both?
Here’s how we’d decide.
Use Private Relay alone if you mainly browse in Safari at home, you already pay for iCloud+, and you don’t care about streaming from other countries. It handles the tracking-by-IP problem well.
Use a VPN if you travel, use public Wi-Fi, use other browsers, have non-Apple devices, or want to choose your location. Turn Private Relay off for the connections where the VPN runs, or just leave it on and let the VPN take precedence.
Use both, at different times if you want the best of each: Private Relay as the everyday default at home, a VPN when you’re on someone else’s network or need a different country.
One more thing worth knowing: Private Relay isn’t the same as DNS-over-HTTPS or a proxy, even if it borrows ideas from both. If the jargon is getting blurry, our DNS over HTTPS vs VPN and VPN vs proxy explainers untangle it.
iCloud Private Relay is a good privacy feature for Safari, and its two-relay design is smarter than most people realise. But it isn't a VPN. It skips most app traffic, ignores other browsers, only works on Apple devices and won't let you pick a country. If you only browse in Safari at home, it may be enough. For public Wi-Fi, travel or streaming, you still want a VPN, ideally an audited one like Proton VPN.