Does FaceApp collect your data and sell it to the Russian government? Does it get access to every photo on your phone? In July 2019 these questions were everywhere. Here is what was really going on, so you can decide for yourself. Tech companies certainly deserve criticism for their data privacy practices, but so do we.
In this article
Why FaceApp went viral again
In early 2017, an app called FaceApp got a lot of press for using artificial intelligence to transform pictures of faces: making people look older or younger, male or female, or adding a smile to look happier.
In July 2019, FaceApp was in the headlines again when celebrities, including the Jonas Brothers, Drake and Dwyane Wade, used the app to show what they might look like when they are much older.
So many people rushed to download the app and turn their own selfies gray that FaceApp became the top free app in Apple’s App Store.
“Russians now own all your old photos”
Within days, privacy concerns about the app were growing. As one dramatic headline in a New York tabloid put it: “Russians now own all your old photos.”
The fears came from three things put together: scary-sounding (but unfortunately not unusual) wording in the app’s terms of service, an unverified (and later deleted) claim from a developer on Twitter that the app was “uploading all your photos“, and the simple fact that the company is based in St. Petersburg, Russia.
When you download the app, it asks for permission to access your photos, send you notifications and use your camera. We are so used to clicking through these permission screens that it’s easy to stop paying attention. Allowing access to our photo library is, in some ways, the new version of blindly agreeing that we’ve read the iTunes terms and conditions. We’re not entirely sure what we’re getting into, but there’s fun on the other side of that dialog box and we want to get to it quickly.
FaceApp’s terms compared with Facebook’s
FaceApp’s terms give the company a generous license to use what you upload, including for commercial purposes. That sounds scary, but big apps use similar wording. In 2019, Facebook’s own terms of service said:
“When you share, post, or upload content that is covered by intellectual property rights (like photos or videos) on or in connection with our Products, you grant us a non-exclusive, transferable, sub-licensable, royalty-free, and worldwide license to host, use, distribute, modify, run, copy, publicly perform or display, translate, and create derivative works of your content.”
Facebook explained it in simpler words: “If you share a photo on Facebook, you give us permission to store, copy, and share it with others.”
Facebook leaves out the “commercial” part, which makes it a little better than FaceApp’s agreement, but you still give the company a generous license.
What FaceApp really does with your photos
:format(webp)/cdn.vox-cdn.com/uploads/chorus_image/image/64749971/faceapp.0.jpg)
FaceApp is a Russia-based app that applies filters to photos. It first went viral in 2017, and this time it caught on because of a filter that makes people look older or younger. As with its first viral moment, many users were surprised to learn that the app’s creators collect metadata from their photos.
A closer look suggests FaceApp isn’t doing anything unusual in its code or its network traffic. So if you’re worried about FaceApp, there are probably plenty of other apps on your phone doing the same thing. Still, the discussion brings attention to standard tech practices that may be more invasive than users realize.
On iOS, you choose the specific photos you want to edit, and there’s no evidence that the app downloads your whole photo library. FaceApp then uploads those specific images to its servers to apply the filter. The app never clearly says that it uploads the photo, but that isn’t unusual, as iOS researcher and Guardian Firewall CEO Will Strafach noted on Twitter:
HOWEVER: they do appear to upload single images in order to apply the filters server-side. while not as egregious, this is non-obvious and I am sure many folks are not cool with that.
— Will Strafach (@chronic) July 17, 2019
In theory, FaceApp could process photos on the phone itself. But Yaroslav Goncharov, a former Yandex executive and CEO of the Russian company behind the app, previously told The Verge that uploaded photos are stored on the company’s servers to save bandwidth when you apply several filters, and that they are deleted shortly after.
How to ask FaceApp to delete your data
FaceApp said it accepts requests from users to remove their data from its servers. At the time, the team said it was “overloaded”, but you could send a request in the app through Settings > Support > Report a bug, with the word “privacy” in the subject line.
Of course, we don’t know whether FaceApp actually deletes the photos. But remember that we upload photos of our faces to companies’ servers all the time. The only difference here is that FaceApp is based in Russia, unlike Facebook or Google, so it inherits the distrust many Americans feel toward that country. FaceApp says no user data is transferred to Russia. Researcher Jane Wong also shared her findings about FaceApp and said she wished users could delete their own data. It now seems they can at least send a request.
Does FaceApp sell your data?
Another possible privacy issue is that the company’s privacy policy uses broad language that lets it use people’s usernames, names and likeness for commercial purposes. Lawyer Elizabeth Potts Weinstein also said the policy isn’t GDPR-compliant:
Their Privacy Policy is not remotely GDPR compliant. It says that your data can be transferred to any location where they have a facility … which means Russia.
— Elizabeth Potts Weinstein (@ElizabethPW) July 17, 2019
This isn’t great, but users often agree to wide-ranging policies written in vague language, which helps companies avoid lawsuits. And users have no say in it: either they use the service or they don’t. FaceApp says it doesn’t sell user data to third parties.
So, should you use FaceApp?
FaceApp may not be a major privacy threat, but as with any app, there are trade-offs. If you want to see what you could look like at 80, you have to hand over your photo, and that includes your face. Some people pointed out that because the company is based in Russia, your photos could be exposed to the country’s security services. You could say the same about apps based in China or even the US, but that doesn’t make it any less troubling. Still, the FaceApp discussion is a useful one: think about how your data will be used before you share it with an unknown app.
Read the FaceApp Privacy Policy first, then decide whether you want to use the app.
