Does Stolen Device Protection protect your photos?

Stolen Device Protection helps your photos indirectly. It makes it harder for a thief who knows your passcode to take over your Apple Account, erase the phone or open apps you have locked. It does not, on Apple’s own list, guard the Photos app or the Hidden album, and by default it switches off at places your iPhone knows, such as home.

What Stolen Device Protection is for

Apple built Stolen Device Protection (SDP) for one specific situation: someone has your iPhone and also knows your passcode. Apple says the extra requirements “help prevent someone who has stolen your iPhone and knows your passcode from making critical changes to your account or device.”

Two conditions apply:

• It needs iOS 17.3 or later.
• It must be on before the phone is lost or stolen. Turning it on afterwards is too late.

What changes away from familiar places

When your iPhone is not at a familiar location, Apple requires Face ID or Touch ID, with no passcode fallback, before certain actions. Apple’s list includes:

• using passwords and passkeys saved in Keychain
• using saved payment methods in Safari autofill
• turning off Lost Mode
• opening a locked app
• erasing all content and settings

Some critical changes go further. To change your Apple Account password, for example, Apple says you must authenticate, wait an hour, then authenticate with Face ID or Touch ID again. Apple calls this the Security Delay.

Not everything is covered. Apple notes you can still use your passcode for Apple Pay purchases.

What this means for your photos

Your account is harder to steal. Because changing your Apple Account password needs biometrics and a one-⁠hour delay, a thief can’t quickly lock you out of the account your iCloud photos live in.

Your phone is harder to wipe. Away from familiar places, erasing needs your face or fingerprint, and so does turning off Lost Mode, so a thief can’t use Erase All Content and Settings or switch Lost Mode off without them.

Your photo library is not on the list. Apple’s list of protected actions doesn’t mention the Photos app, the Hidden album or Recently Deleted. Apple says those two collections open with Face ID, Touch ID or your passcode. Apple does not document whether SDP removes the passcode option for them away from home. Until it does, assume someone holding your unlocked phone and your passcode can open your Hidden album.

Lock apps to extend the protection

Locked apps arrived in iOS 18. A locked app normally opens with Face ID, Touch ID or your passcode. With SDP on, Apple says locking an app extends SDP’s extra layer to that app: away from familiar locations, it “can be opened only with Face ID or Touch ID.”

That makes locking useful for any app that holds private photos, such as a messaging app or a cloud storage app. Two limits:

• Some built-⁠in apps can’t be locked. Apple lists Calculator, Camera, Clock, Contacts, Find My, Maps, Shortcuts and Settings.
• Photos is not on that list, but Apple doesn’t confirm in writing that it can be locked. Check on your own iPhone. Apple’s iPhone User Guide has the current steps for locking an app.

A locked app locks again automatically after you quit it, so opening it once doesn’t leave it open.

Make it apply at home too

By default, Apple says that at a familiar location “these additional steps are not required, and you can use your iPhone passcode like usual.” Familiar locations are places such as home and work.

That matters if the person you are worried about lives with you or works near you. At home, SDP does nothing to stop them. To change that, Apple says you can tap Stolen Device Protection and choose Always under Require Security Delay. The rules then apply everywhere, including at home.

The trade-⁠off is convenience: you will need Face ID or Touch ID, and sometimes the one-⁠hour wait, for protected actions wherever you are.

What Stolen Device Protection doesn’t do

• It doesn’t name the Photos app or the Hidden album. Apple’s list names locked apps, so assume anyone with your passcode can browse your photos.
• It doesn’t apply at familiar places unless you choose Always.
• It doesn’t help if it was off when the phone was taken.
• It still accepts the passcode for Apple Pay.

For photos that must stay private from someone who knows your passcode, the passcode can’t be the only thing between them and the photos. That means a separate app with its own PIN or pattern, ideally one that encrypts the photos with its own key and limits repeated guesses.

A five-⁠minute checklist

1. Make sure your iPhone runs iOS 17.3 or later and turn on Stolen Device Protection now. Apple’s support article has the steps.
2. If the risk is someone close to home, choose Always under Require Security Delay.
3. Lock the apps that hold private photos, and check whether Photos itself can be locked on your phone.
4. Use Face ID or Touch ID in public so fewer people see you type your passcode.
5. Before you sell, give away or trade in the phone, turn Stolen Device Protection off, as Apple advises.