A Privacy Promise Is Not a Control: Move Your Photos Home

On Wednesday, 21 October 2026, New Mexico state District Judge Francis Mathew ordered Meta Platforms to pay the state $25 billion. A jury had found last month that Meta misled consumers about its data-privacy practices on Facebook. According to reporting by Reuters (Diana Novak Jones), the Associated Press and CBS News, the judge found that a penalty of more than $219 billion was warranted under state law and then reduced it. The $25 billion is the reduced figure, not the amount the court first calculated. A Meta spokesperson did not immediately respond to a request for comment.

The case began in 2021, when New Mexico's attorney general sued Meta after Cambridge Analytica, a British political consulting firm, harvested personal data from as many as 87 million Facebook users through a third-party app. Nobody broke in. People clicked through a permission screen inside a platform they trusted. The ruling settles whether a promise was broken. It does not put a single photo back under your control.

What a self-hosted Google Photos alternative actually replaces

A big-cloud photo service does three jobs. It uploads pictures from your phone, it indexes them so you can search and build albums, and it keeps a copy somewhere else. A self-hosted server has to do all three, or it is just a folder.

For the camera roll I use Immich. It is an open-source, self-hosted photo and video backup server licensed AGPL-3.0, and its GitHub repository lists more than 100,000 stars as of 21 October 2026. The phone app uploads new photos in the background, and the web interface gives you a timeline, albums and search. For documents, shared folders and calendars I use Nextcloud, which handles files, photos and calendars in one place. I compared it against a big-cloud account in Nextcloud vs Google Drive.

Whichever you pick, you end up owning three separate things:

The original files. These are the JPEG, HEIC and video files themselves, sitting in a folder on your disk.
The database that indexes them. Immich keeps albums, people, metadata and users in a PostgreSQL database. Nextcloud keeps its file index, shares and settings in its own database. Files without the database lose their albums. A database without the files is useless.
The backups of both. A copy of the files and a dump of the database, stored somewhere other than the server.

Owning these three is the whole point. It also means you are the one who has to keep them.

The permission chain nobody audits

When you click "Log in with Google" or "Continue with Facebook", the app asks the platform for scopes. A scope is a named permission, such as your basic profile, your email address, your contacts or your photos. You approve a consent screen once, and the app receives a token that keeps working until you or the platform revokes it.

The dangerous part is reach. A quiz app that is allowed to read your profile may also be able to read data about your friends, who never installed it and never saw a consent screen. That is the mechanism behind the "as many as 87 million" figure: people who installed one app exposed data about people who did not.

You can audit what you have already connected in a few minutes. Menu names change over time, but they are currently close to these:

Google: myaccount.google.com, then Security, then "Your connections to third-party apps and services".
Facebook: Settings and privacy, then Settings, then "Apps and websites".
GitHub: Settings, then Applications, then "Authorized OAuth Apps".

Remove anything you do not recognise or have not used in months. For the apps you keep, read the permissions listed and ask whether that app needs them.

Be honest about the limit. Revoking access stops future requests today. It cannot tell you what an app copied before you revoked it, and you cannot verify what a platform did on its own servers. Data that has already left is out of your reach. I made the same argument about audiences in own your audience: anything that lives only on someone else's platform is held on their terms.

Moving the files that matter without losing any

Photos and videos go first, because they cannot be recreated. Work in this order.

Measure the library. Check the storage page of your account and write down the size it shows for photos. Call that number L.
Do the disk-space sum with your own number. During the move you need room for the downloaded archives (about L) plus the extracted files (about L), so plan for at least 2 x L free on the working disk. Afterwards the server needs L plus headroom for the thumbnails and video previews Immich generates, and each backup disk needs at least L as well.
Use the provider's own export. For Google, go to takeout.google.com, deselect everything, then select only Google Photos and choose large archive sizes. For Meta, use Download Your Information in Accounts Center, choose your media and pick high quality. Download every part of the archive.
Verify before you trust it. Test each archive, extract it, then count files and record checksums.

unzip -t takeout-001.zip
find ./export -type f | wc -l
cd export && find . -type f -exec sha256sum {} + > ../manifest.sha256

Import. For Immich, follow the official Docker Compose install, then upload the extracted folder with the Immich CLI (immich upload --recursive ./export) or through the web interface. For Nextcloud, upload through the desktop client, or copy the files into the user's data folder and run occ files:scan --all. Takeout often stores dates and other metadata in separate JSON files next to each photo, so spot-check that old photos land in the right year.
Check the copy on the server. Copy the export to the server's storage, run sha256sum -c manifest.sha256 inside the copied folder, and make sure every line says OK.
Delete nothing at the source yet. Wait until the import is complete, dates look right, a backup has run and you have restored a few files from it.

The true cost of owning it

Disks fail, usually without warning. RAID keeps a server running through a dead disk, but it is not a backup, because a deleted file or a corrupted database is mirrored instantly. You need a separate backup copy on another disk, and an off-site copy in another building or an encrypted remote bucket. Tools like restic or Borg handle this well.

The database needs its own backup. For Immich, a nightly dump looks like this (adjust the container name to match yours):

docker exec -t immich_postgres pg_dumpall --clean --if-exists --username=postgres | gzip > immich-db.sql.gz

Then there is patching. Containers need updates, and photo servers can change their database during upgrades, so read the release notes before every update. Electricity is a real bill, too. Put a plug-in power meter on the box, then multiply its watts by the hours in a month and by your rate.

Finally, when the box is down at 3am, nobody gets paged except you. That is the trade: you swap someone else's promise for your own maintenance. I think it is worth it, but it is work.

What I would do this week on my own box

Audit connected apps on Google, Facebook and GitHub, and revoke anything unused.
Run df -h and compare free space against your 2 x L figure.
Request the Google Takeout and Meta exports now, because they can take a while to prepare.
Install Immich with Docker Compose, put the upload location on the disk you measured, and turn on phone backup for new photos.
Import the export and verify it with the checksum manifest.
Set up the nightly database dump plus a restic or Borg backup to a second disk and an off-site target, then restore one album to prove it works.

Leave the originals at the source for at least a month after all of this passes.

If you would rather not be the one paged

Some people want their photos on their own hardware but do not want to be the sysadmin. If that is you, I set up Immich and Nextcloud servers with tested backups and keep them patched. Details are on the services page.

Fiverr: hiteshsaini459 · Upwork: hiteshsaini25