Photography via instagram.com/jonasbrothers

Downloaded FaceApp? Here’s Whether You Should Be Worried About Your Data

As fun as this little game might be, it turns out there may be a big downside.

This past week, you’ve probably been seeing photos of the Jonas Brothers, Drake, Mindy Kaling and other celebs looking grey, wrinkled and a tad wizened—it’s because they’d all been fiddling around with the viral FaceApp filter that, once you upload a selfie, shows you through AI what you might look like in a few decades. Over 100 million people have downloaded this app from Google Play, reports Forbes, making it the top-ranked app on the iOS store in over 120 countries.

As fun and playful as that little game might be, it turns out there might be a big downside.

The app itself isn’t new—it caused controversy when it launched back in 2017 with “ethnicity filters” and saw a huge bump last year when it released a new feature that estimated what you would look like as a member of the opposite sex—but a since-deleted tweet earlier this week about the app’s possible nefarious connections and intentions set off a frenzy. Here’s everything about the app that’s been stressing people out, along with experts weighing in on just how concerned we need to be.

Concern 1: The app has access to your entire photo library

A software developer claimed on Twitter that FaceApp uploads all of your photos to the cloud, not just the ones you selected to run through the app’s AI filter, causing users to panic. FaceApp has since denied this claim. “We only upload a photo selected by a user for editing. We never transfer any other images from the phone to the cloud,” the app’s founder Yaroslav Goncharov told The Washington Post. The Guardian reports that a French security researcher was able to confirm this; he ran a check on the app and concluded that “it wasn’t actually uploading your entire camera roll—just the photo you were modifying.”

However, Goncharov did tell the Post that uploaded photos get stored in the cloud for a period of time.

“We might store an uploaded photo in the cloud. The main reason for that is performance and traffic: we want to make sure that the user doesn’t upload the photo repeatedly for every edit operation. Most images are deleted from our servers within 48 hours from the upload date.”

As Wired notes, though, “admittedly there’s no way to confirm that it does so in practice.”

Concern 2: The app’s terms of use

Some tech journalists also began to note that the app’s terms of use—which, lets be real, no one ever reads—might warrant further looking into. While its terms and conditions aren’t that different from other apps that also require access to your photos and data, their fine print does contain some language about potential “commercial” use that might be cause for concern: “You grant FaceApp a perpetual, irrevocable, nonexclusive, royalty-free, worldwide, fully-paid, transferable sub-licensable license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, publicly perform and display your User Content and any name, username or likeness provided in connection with your User Content in all media formats and channels now known or later developed, without compensation to you.” The terms go on to say that, “By using the Services, you agree that the User Content may be used for commercial purposes.”

According to Popular Science, “The terms contain troubling phrases like “commercial” and “sub-licensable,” which means your images—along with information associated with them—could end up in advertisements. This doesn’t mean that the company “owns” your photos like some news outlets have suggested, but rather that they can use them for pretty much whatever they want down the road.”

Concern 3: The app is based in Russia

FaceApp is owned by a company based in St. Petersburg called Wireless Lab, setting off concerns among users about the safety and security of their data. In an attempt to clarify Russia’s involvement, Goncharov told Tech Crunch that though FaceApp’s research-and-development team is based in Russia, no user data is “transferred” into the country.

He also clarified that the company’s servers are based in the US, but as Forbes explains, “Given that the developer company is based in St. Petersburg, the faces will be viewed and processed in Russia. The data in those Amazon data centres could be mirrored back to computers in Russia. It’s unclear how much access FaceApp employees have to those images, and Forbes hadn’t received comment from the company at the time of publication about just what it does with uploaded faces.

Given Russia’s nefarious meddling with the 2016 American election, users—and politicians—are justifiably concerned. US senator Chuck Schumer has called for the FBI to investigate FaceApp over fears about “national security and privacy risks.”

While it’s not yet confirmed if the FBI will launch an investigation, CNN notes that “the Democratic National Committee sent a security alert to 2020 presidential campaigns Wednesday afternoon warning them not to use the app.”

Concern 4: Future uses of user data

FaceApp’s privacy policy states that, in addition to photos generated via the app, it also collects location information and information about users’ browsing history. Although Goncharov has clarified to various media outlets that they “don’t sell or share any user data with any third parties,” Mashable notes that their policy “explicitly says that it shares information with “third-party advertising partners,” in order to deliver targeted ads.”

Goncharov, the app’s founder, has said that users who want to remove their data from FaceApp can make the request by heading to the app’s Settings, then clicking “Support” and “Report a bug” with “Privacy” in the subject line. But according to the Washington Post, the solution isn’t so simple. “If a user deletes content from the app, FaceApp can still store and use it, the terms say.”

Privacy expert Ann Cavoukian, who is executive director of the Global Privacy and Security by Design Centre, tells The Star why FaceApp’s potential privacy issues are particularly concerning.

“Most apps are really bad, there’s no question,” she says. “But this one captures your facial image, it’s the most sensitive information out there. You don’t want this compromised and used in ways that you never intended.”