FaceApp: The Trending Aging and Gender Swap App Is A Privacy Threat

FaceApp, initially released in January 2017, is a Russia-based app for iOS and Android that applies filters to photos. The app developed by Wireless Lab, based in St. Petersburg, is in the spotlight this week due to its alleged privacy concerns.

FaceApp has over a hundred million downloads, and the app is famous among people of all ages,  including several celebrities who are using the app to transform their photos by making them appear decades older than they really are.

What started off as a #FaceAppChallenge, later engulfed into a global phenomenon, and as of Wednesday, FaceApp was the top trending free app in Apple’s App Store.

Stop using FaceApp because there are no controls on how your face data is used.

But also—walking around anywhere can get your face included in facial recognition databases.

So … stop going outside?

This privacy protection model doesn’t work.

— Tiffany C. Li (@tiffanycli) July 17, 2019

Get detailed insights on how the face detection technology works and risks associated with it.

Is FaceApp a Threat?

It’s important to note that just because the app is coming from Russia, doesn’t necessarily mean it’s dangerous, “but it means that we have less control.” While it’s true that Russia is doing a lot of work in the field of Artificial Intelligence, it’s safe to say that the United States and China are equally contributing to Artificial Intelligence.

Earlier this year, FBI Director, Christopher A. Wray, pointed out that Russia still remains a significant counterintelligence threat to the United States and other countries of the world. It would be deeply troubling if the sensitive personal information of U.S. citizens was provided to a hostile foreign power actively engaged in cyber hostilities against the United States.”

Naturally, it can’t be said for certain whether FaceApp actually deletes the photo data or not, but it’s worth remembering that we do upload our photos (containing our face) to companies’ servers all the time. Yes, the only difference, in this case, is that as opposed to Facebook, Instagram, Twitter or Google, FaceApp is Russia-based, and as a result, it assumes hostility because of Americans’ perception of the country.

FaceApp says no user data is transferred to Russia. According to FaceApp’s privacy policy, the use of the app gives them access to collect:

• User Content (e.g., photos and other materials) that you post through the Service.
• Cookies and similar technologies like pixels, web beacons, and local storage to collect information about how you use FaceApp
• Measure traffic and usage trends for the Service
• Ask advertisers or other partners to serve ads or services to your devices
• Automatically record certain log file information, including your web request, Internet Protocol (“IP”) address, browser type, referring / exit pages and URLs, number of clicks and how you interact with links on the Service, domain names, landing pages, pages viewed, and other such information
• Small data files or similar data structures stored on or associated with your mobile device
• Metadata

According to FaceApp’s privacy terms, even after users delete the app, FaceApp can still store and use information collected. Here’s FaceApp’s privacy policy:

1. FaceApp performs most of the photo processing in the cloud. We only upload a photo selected by a user for editing. We never transfer any other images from the phone to the cloud.
2. We might store an uploaded photo in the cloud. The main reason for that is performance and traffic: we want to make sure that the user doesn’t upload the photo repeatedly for every edit operation. Most images are deleted from our servers within 48 hours from the upload date.
3. We accept requests from users for removing all their data from our servers. Our support team is currently overloaded, but these requests have our priority. For the fastest processing, we recommend sending the requests from the FaceApp mobile app using “Settings->Support->Report a bug” with the word “privacy” in the subject line. We are working on the better UI for that.
4. All FaceApp features are available without logging in, and you can log in only from the settings screen. As a result, 99% of users don’t log in; therefore, we don’t have access to any data that could identify a person.
5. We don’t sell or share any user data with any third parties.
6. Even though the core R&D team is located in Russia, the user data is not transferred to Russia.

What Caused the Confusion?

Initially, people thought that their entire gallery got uploaded to FaceApp’s servers after you grant access to the photos. However, that’s not true, and FaceApp confirmed it:

“We don’t do that. We upload only a photo selected for editing. You can quickly check this with any of network sniffing tools available on the internet.”

In light of the privacy concerns, the Democratic National Committee urged their campaign staff to delete the app from their phones as a precautionary measure.

Not to take away FaceApp’s limelight but other social media platforms such as Facebook and Instagram have been under fire for similar privacy concerns in the past. While it’s true that if we’re uploading our pictures online, we have less control over its privacy especially if those pictures are located on a server of a different country.

Learn How to Delete Your Facebook and Instagram accounts.

With that being said, the privacy laws in the U.S. aren’t solid either, which calls for stringent discussion on privacy laws. At the same time, there are numerous ways through which you can protect your privacy and to begin with, you should limit the sharing of your personal information and remove any metadata from the pictures you’ve uploaded such as location information or any other tags.

Online Privacy and Who to Trust?

Since you can’t trust these apps that are free in nature, you really have to ask: ‘what’s their business model?’ If they’re not charging you, how are they surviving? Is it because they’re selling your metadata and targeting you with ads? Are you the product?

While it can be said that FaceApp isn’t a significant privacy concern, but as with any app, there’s always something that you’ll have to forgo. If you don’t want your picture to land in the hands of someone who you don’t know and trust, you shouldn’t share it in the first place.

And if you do want to know how you’ll look like when you turn 80 years old, I guess you’ll just have to wait it out and see it for yourself at that time rather than giving away your private photos to an app.

Ultimately, security agencies in the US believe that with the app-based in Russia, your privacy is at risk, but it’s worth mentioning that similar claims can easily be made for apps that are based in China or even the US. Who’s to say they aren’t a privacy concern? At the same time, if you really care about your privacy, you can delete FaceApp altogether.