How to bypass Screen Time photos restrictions using the system photo picker in iOS and iPadOS?

Question

Level 1

14 points

How to bypass Screen Time photos restrictions using the system photo picker in iOS and iPadOS?

Issue Summary:

There is a major logical security and privacy oversight in iOS and iPadOS where a child can view their entire camera roll and video vault even if the native Photos app is blocked via Screen Time, and even if Content & Privacy Restrictions are set to "Don't Allow Changes" for Photos.

A user can bypass these restrictions by triggering the out-of-process system photo picker (PHPicker) via individual app settings menus, effectively using it as a full-screen photo and video viewer.

Steps to Reproduce:

Set up Photo Restrictions:

Block the Photos app using Screen Time (via App Limits or Downtime).
Navigate to Settings > Screen Time > Content & Privacy Restrictions > Photos, and set it to "Don't Allow Changes".

Open Settings: Scroll down and go to Settings > Apps (or the individual third-party app list at the bottom of Settings).
Select an App: Tap on any third-party app (e.g., a messaging app, browser, or game) and tap Photos.
Trigger the Loophole: Note that while the master menu under Settings > Privacy & Security > Photos is greyed out, the permission menu under Settings > Apps > [App Name] remains fully interactive.
Tap Limited Access.

Expected Behavior:

If the Photos app is blocked via Screen Time, triggering photo selection from Settings should require the Screen Time passcode or be completely disabled.
If Content & Privacy Restrictions are set to "Don't Allow Changes" for Photos, individual app permission pages under Settings > Apps > [App Name] should be locked or greyed out, preventing any changes or modal popups.

Actual Behavior:

Toggling "Limited Access" under an individual app's settings menu instantly initializes the system-level photo picker (PHPicker) popup. Because PHPicker runs out-of-process as a trusted OS daemon, it bypasses the Photos app limit and exposes the entire, unrestricted photo library and video vault to the user.

System Impact & Why This is a Logical Bug:

While PHPicker is designed as a secure, out-of-process component to protect user privacy from third-party apps, it currently lacks an OS-level check against Screen Time parental controls. This allows a restricted user to use the system picker interface as a complete substitute for the blocked Photos app.

Environment:

OS: iOS and iPadOS (verified on all recent releases)
Devices: iPhone and iPad

[Re-Titled by Moderator]

Original Title: [Bug Report] Screen Time Privacy Bypass: Photo Library remains fully viewable via Settings > Apps permissions despite app blocks and privacy restrictions

iPhone 16 Pro Max, iOS 26

Posted on Jul 26, 2026 1:50 AM

Reply

Answer 1

Top-ranking reply

SravanKrA

Level 10

442,810 points

Jul 26, 2026 2:46 AM in response to skyairmj

The key is that "Do Not Allow Changes" does not mean "Do Not Allow Access."

On iPhone, Settings → Screen Time → Content & Privacy Restrictions → Photos → Don't Allow Changes only prevents modifying the Photos library. For example, it prevents:

Deleting photos.
Editing photos.
Changing Photo Library settings.

It does not prevent viewing existing photos or selecting them in the system photo picker (PHPicker).

This will prevent access to Photos

Use Settings → Privacy & Security → Photos and set the app's permission to None

If Content & Privacy Restrictions are enabled in Screen Time and Allow Changes → App Privacy is set to Don't Allow, then the child cannot change an app's Photos permission from None to Limited or Full Access without the Screen Time passcode.

Reply

Answer 2

skyairmj Author

Level 1

14 points

Aug 3, 2026 7:34 PM in response to Mac Jim ID

Thanks for the responses and for clarifying the technical distinction between App Limits and Content & Privacy Restrictions. However, the core issue here isn't just a misunderstanding of setting definitions—it is a functional security inconsistency and a parental control bypass within iOS/iPadOS logic.

Here is why this is a legitimate issue and why it matters:

1. UI & Restriction Policy Inconsistency

When Content & Privacy Restrictions are set to "Don't Allow Changes" under Photos:

Navigating to Settings > Privacy & Security > Photos correctly greys out the entire menu to prevent modifications.
The Inconsistency: Navigating to Settings > Apps > [App Name] > Photos remains fully active and editable. If global privacy changes are restricted, individual app sub-menus should not remain interactive to override or alter photo access modes.

2. The Exploit: Settings Acts as an Unrestricted Photo Gallery

The primary issue isn't whether a third-party app receives photos; it is that the Settings app itself launches the System Photo Picker (PHPicker) as a modal UI popup:

When a restricted user taps "Limited Access" inside Settings > Apps > [App Name] > Photos, iOS immediately invokes the out-of-process system photo picker (PHPicker).
This popup displays a full-screen, scrollable grid of the user’s entire media library, complete with search, albums, and video playback capabilities.
Because PHPicker runs as a trusted system daemon, it does not check Screen Time limits. A restricted user (such as a child) can use this popup directly inside Settings as a fully functional photo and video viewer—completely bypassing both the Screen Time block on the Photos app and the Screen Time passcode.

3. Why It Matters

Parental Control Intent: Parents who block the Photos app and lock privacy settings expect that a child cannot browse their camera roll on the device.
Security & Privacy Overreach: Even if PHPicker is designed to protect user data from third-party apps, triggering an interactive media browser directly through the Settings app menu creates an unintended backdoor for viewing restricted content.

If Screen Time locks down photo app changes, invoking the photo picker daemon from within individual app settings menus should either require the Screen Time passcode or be disabled entirely.

Reply

Answer 3

Aug 2, 2026 2:50 PM in response to skyairmj

What is your actual concern about a user viewing their own photos on the device?

As stated the Screen Time Setting for Photos is to not allow changes. That is a concern where parental controls may be needed for an app that has access to the photo library. For example, you may not want an app to be able to access the entire photo library and want to restrict its access to a subset of photos, that is the purpose of the screen time setting. It is stated clearly on the Screen Time page where that setting resides:

"Disallowing changes locks the settings shown below and prevents new apps from using your photos.

Photos stored on your iPhone may contain other information such as where and when the photo was taken and the depth of field."

That is exactly what that setting is doing. Blocking the Photos app with App Limits does not affect other apps that have access to the photo library and it is not designed to, you would need to add a limit to that particular app if you want its usage restricted by time and/or prevent the app from accessing the photo library where it will be enforced when you use the Screen Time setting to not allow changes.

Not allowing changes to Photos with Content & Privacy Restrictions is a completely different function the using an App Limit on the Photos app. If you want to restrict access to the photos app from an app, you would do that in Content & Privacy Restrictions, and if you want to limit the usage of the Photos app, then you would do that with App Limits/Downtime.

If you are looking for an additional feature that prevents photos access entirely through screen time for some reason, beyond using the Photos app, you can send a feature request here:

Feedback - iPhone - Apple

Feedback - iPad - Apple

Reply

Answer 4

SravanKrA

Level 10

442,810 points

Jul 26, 2026 2:32 AM in response to skyairmj

Now with Feedback Assistant available on iPhone, iPad, Mac, and the web, it's easier to submit effective bug reports and request enhancements to APIs and tools ...

Feedback Assistant

Reply

Answer 5

skyairmj Author

Level 1

14 points

Aug 1, 2026 11:21 PM in response to SravanKrA

The goal is to prevent children or other people from viewing camera roll, but with all of those restrictions set on Screen Time, people can still get the entire camera roll from individual app permission pages, and view the photos/videos on the system-level photo picker (PHPicker) popup.

Photos app is blocked via Screen Time
Content & Privacy Restrictions are set to "Don't Allow Changes" for Photos via Screen Time

Please check the attached screenshots from individual app permission pages:

Reply

Answer 6

Aug 2, 2026 2:19 PM in response to skyairmj

skyairmj wrote:

• The goal is to prevent children or other people from viewing camera roll

Did you read the reply from SravanKrA?

The "Don't Allow Changes" restriction that you told us that you set is not meant to do this, and is not the right tool for doing this. If that restriction allows viewing photos – but not adding, editing, or deleting any – then iOS isn't exhibiting a "bug" and what you are doing isn't "bypassing Screen Time photos restrictions".

Reply

Answer 7

Aug 2, 2026 3:01 PM in response to Mac Jim ID

Another example is that an App Limit on the Photos app, does not mean you can't send a photo from your Photo Library using the Messages app. If you wanted to restrict access to the Photo Library, that would be done with the Messages app. The Photo Library is not an app that includes any App Limit, its access is controlled by the app that requests permission to access the Photo Library and that is done with the Content & Privacy restrictions.

Reply

Answer 8

Aug 2, 2026 3:07 PM in response to Mac Jim ID

Another example is that an App Limit on the Photos app, does not mean you can't send a photo from your Photo Library using the Messages app. If you wanted to restrict access to the Photo Library, that would be done with the Messages app. The Photo Library is not an app that includes any App Limit, its access is controlled by the app that requests permission to access the Photo Library and that is done with the Content & Privacy restrictions.

It seems that it was already explained to you in your duplicate post, but hopefully this additional information will bring a little more clarity into what the App Limit does and the purpose of using the Content & Privacy Restriction. Duplicate posts may be deleted and you will lose any information that has been provided on that post.

Reply

Answer 9

SravanKrA

Level 10

442,810 points

Jul 26, 2026 2:40 AM in response to skyairmj

It is not clear where you set these restrictions on Screen Time (Did you select your Child under Secreen time). See the pic below

Reply