How to bypass Screen Time photos restrictions using the system photo picker in iOS and iPadOS?
Issue Summary:
There is a major logical security and privacy oversight in iOS and iPadOS where a child can view their entire camera roll and video vault even if the native Photos app is blocked via Screen Time, and even if Content & Privacy Restrictions are set to "Don't Allow Changes" for Photos.
A user can bypass these restrictions by triggering the out-of-process system photo picker (PHPicker) via individual app settings menus, effectively using it as a full-screen photo and video viewer.
Steps to Reproduce:
- Set up Photo Restrictions:
- Block the Photos app using Screen Time (via App Limits or Downtime).
- Navigate to Settings > Screen Time > Content & Privacy Restrictions > Photos, and set it to "Don't Allow Changes".
- Open Settings: Scroll down and go to Settings > Apps (or the individual third-party app list at the bottom of Settings).
- Select an App: Tap on any third-party app (e.g., a messaging app, browser, or game) and tap Photos.
- Trigger the Loophole: Note that while the master menu under Settings > Privacy & Security > Photos is greyed out, the permission menu under Settings > Apps > [App Name] remains fully interactive.
- Tap Limited Access.
Expected Behavior:
- If the Photos app is blocked via Screen Time, triggering photo selection from Settings should require the Screen Time passcode or be completely disabled.
- If Content & Privacy Restrictions are set to "Don't Allow Changes" for Photos, individual app permission pages under Settings > Apps > [App Name] should be locked or greyed out, preventing any changes or modal popups.
Actual Behavior:
Toggling "Limited Access" under an individual app's settings menu instantly initializes the system-level photo picker (PHPicker) popup. Because PHPicker runs out-of-process as a trusted OS daemon, it bypasses the Photos app limit and exposes the entire, unrestricted photo library and video vault to the user.
System Impact & Why This is a Logical Bug:
While PHPicker is designed as a secure, out-of-process component to protect user privacy from third-party apps, it currently lacks an OS-level check against Screen Time parental controls. This allows a restricted user to use the system picker interface as a complete substitute for the blocked Photos app.
Environment:
- OS: iOS and iPadOS (verified on all recent releases)
- Devices: iPhone and iPad
[Re-Titled by Moderator]
Original Title: [Bug Report] Screen Time Privacy Bypass: Photo Library remains fully viewable via Settings > Apps permissions despite app blocks and privacy restrictions
iPhone 16 Pro Max, iOS 26