Face ID Alternate Appearance: The Privacy Risk of a Second Face

What Face ID's alternate appearance actually is

Apple built this feature so a single person could register two versions of their own face, for example with and without glasses, a beard, or a hat, so Face ID would recognize them more reliably. The setup path is straightforward: open Settings, go to Face ID & Passcode, enter your passcode, then tap "Set Up an Alternate Appearance" and follow the on-screen prompts (Apple Support).

Nothing in that flow checks whose face you're scanning. Because of that, plenty of couples, roommates, and family members use the second slot to let someone else unlock the phone, according to how-to coverage from outlets like iMore and Macworld. Apple only ever allows one primary face and one alternate appearance, for a maximum of two faces total, and there's no naming, labeling, or per-person profile to distinguish them.

What that second face can actually do

This is the part that catches people off guard: an alternate appearance isn't a limited guest mode. Once a face unlocks Face ID, it has the same access as the primary face, including:

There's no way to scope an alternate appearance down to "unlock the phone but not Apple Pay" or "unlock the phone but not Messages." It's all-or-nothing access, tied to whichever face is presented to the camera.

• Unlocking the home screen and every app that doesn't have its own separate lock
• Approving Apple Pay purchases
• Authenticating App Store and iTunes purchases
• Autofilling saved passwords and passkeys
• Unlocking Apple's built-in Hidden album in Photos, which uses the same Face ID or Touch ID check as the rest of the device (Apple Support)

The part nobody mentions: you can't remove just one face

Here's the detail that turns this from a minor convenience into a real privacy gap. Once an alternate appearance is enrolled, iOS gives you no option to delete that face on its own. There is no list of "faces on this device," no per-face toggle, nothing to select and remove. The only way to take a second face off the phone is to tap "Reset Face ID," which wipes all facial data, primary and alternate, immediately and without a confirmation prompt, according to MacRumors' walkthrough of the setup and removal process. After that, Face ID has to be set up again from scratch with only your own face.

That matters after a breakup, after a falling out with a roommate, or simply when you decide the arrangement was a bad idea. There's no quiet, surgical way to revoke access. The only path is a full reset and re-enrollment, which most people don't realize until they go looking for the "remove" button that doesn't exist.

Apple's Hidden album in Photos illustrates the same access boundary from a different angle: it's a genuinely useful, Apple-built feature, locked with Face ID or your passcode since iOS 16, but it unlocks with whatever face Face ID already trusts, alternate appearance included (Apple Support). It also syncs through iCloud Photos, so hidden content isn't confined to a single locked device the way people sometimes assume.

A separate lock is the more precise fix

If the goal is "let someone borrow my phone sometimes" but not "give them permanent, revocable-only-by-nuking-everything access to my private photos," a second, independent lock on just the private content solves that more precisely than Face ID's alternate appearance ever can.

Secure Folder: Incogni Vault takes private photos, videos, documents, and notes out of the Photos app entirely and stores them behind their own PIN or Face ID / Touch ID, separate from the phone's unlock method. Because Secure Folder's vault PIN is independent of the device's Face ID enrollment, someone who has an alternate appearance registered on your phone (or who simply knows your passcode) still can't see what's inside the vault without that separate PIN. Vault content stays on the device and isn't uploaded anywhere; the only thing that leaves the phone is anonymous usage analytics that contains nothing from inside the vault.

Secure Folder also includes a decoy vault (an Incogni Pro feature): a second, different PIN opens an entirely separate vault holding only whatever you've put there, with no indication anywhere in the app that a real vault exists. It's worth being clear about what this is and isn't: the decoy vault is a duress option for situations where someone is pressuring you to unlock something, not a recovery tool. There's no move or transfer feature between the real vault and the decoy vault: a folder belongs to whichever vault it was created in, and getting content from one to the other would mean exporting it out and reimporting it manually, the same as with any other file. Face ID / Touch ID unlocks the vault independently of the PIN, which makes biometrics a reasonable answer if you forget your PIN, but there is no PIN reset and no way for anyone, including the developer, to recover a forgotten PIN.