Does 'Full Access' to Photos include your Hidden album on iPhone?

When iOS 16 added a Face ID lock in front of the Hidden album inside Apple Photos (Apple Support 104987), most iPhone owners reasonably assumed that Face ID lock also blocked third-⁠party apps from reading their hidden pictures.

A quick look at Apple’s own developer documentation for PhotoKit (PHFetchOptions.includeHiddenAssets) shows why that assumption is dangerous: the Face ID lock on the Hidden album is a UI gate inside the Apple Photos app, not an API barrier for apps you granted Full Photo Access.

What Apple’s PhotoKit API exposes to “Full Access” apps

When you tap Allow Full Access on an iPhone app’s permission prompt, that app can query the system PHPhotoLibrary in the background whenever the app is open. By default, includeHiddenAssets is false, so well-⁠behaved custom photo grids do not accidentally show your hidden photos. However, a developer only has to add one line of Swift code to request them:

let options = PHFetchOptions()
options.includeHiddenAssets = true
let allPhotos = PHAsset.fetchAssets(with: .image, options: options)

Comparing the 4 iOS Photos permission tiers

According to Apple’s iPhone User Guide on app permissions and Apple’s WWDC sessions on Limited Photos Library, here is what each permission setting actually allows:

How to audit and revoke Full Photo Access in four steps

Almost no social media, messaging, shopping or AI-⁠avatar app genuinely needs Full Access to your entire life’s photo library just so you can post one picture a week. Audit your list right now:

1. Open Settings on your iPhone, scroll down and tap Privacy & Security, then tap Photos.
2. Look at the top of the list where iOS groups apps with Full Access and shows how many thousands of photos they can reach.
3. Tap each social, shopping, chat, game or editing app and change its permission from Full Access to Limited Access, Add Photos Only or None.
4. For photos that must never be reachable by Apple’s PhotoKit API under any permission setting, import them into a separate on-⁠device encrypted vault app, confirm Remove from Photos, and empty Photos > Utilities > Recently Deleted.

For a deeper walkthrough of how iOS photo pickers and metadata permissions work, read our companion guide on which apps can see your photos.