With the popular FaceApp, you can look older in photos, but you can also give your photos and personal information to a company that can sell them. What exactly can the buyers of this information do?
What is FaceApp?
FaceApp is a popular smartphone app that lets you apply a filter to your selfies. This allows you to see, for example, what you would look like as an old man or a woman. The app's popularity has skyrocketed in recent weeks and is also used by many celebrities.
What exactly does FaceApp collect?
FaceApp collects and stores all the photos taken by users. In addition, data that gives information about your phone, along with cookies, logs, your location, and your app usage.
What does FaceApp do with this data?
All your data is shared with “companies in a group to which FaceApp belongs or companies that may later join this group.”.
Because other parties are free to join this group, theoretically any company has access to the data. This allows anyone to buy it. FaceApp does not disclose which institutions have been allowed to examine the data so far.
Can data be compromised?
If FaceApp data falls into the wrong hands, it can be used to build an extensive profile of your online behavior. Your photo and phone number can be linked to data from, for example, data breaches to determine your interests. Even leaked email addresses, credit cards, and passwords can be linked to this profile.
By sharing cookies from your device, even your internet could be mapped. This data could be used, for example, for identity theft or espionage.
Is this really happening?
There are no specific cases where FaceApp data appears to have been misused, for example, by criminals. However, the amount of data processed and the privacy terms make this theory possible.
Cybercriminals have previously exploited data leaks in a similar way, for example, to steal identities or hack accounts.
Surely tech companies are collecting data more often? Why is there so much fuss over FaceApp?
FaceApp is made by Wireless Labs, a company based in Russia. The company doesn’t have a European office, which makes it difficult to invoke European privacy law. The company likely won’t respond to requests to hand over or delete your data. Additionally, FaceApp won’t tell you where your data is currently located.
The fact that the company is based in Russia is also a sign of distrust. Government hackers in the country have been accused several times of hacking attacks and attempts to spread disinformation on social media. Antivirus company Kaspersky even had to move its headquarters out of Russia, following allegations that the company was collaborating with the local government.
How can I prevent the use of my data?
The data collected by FaceApp can no longer be removed by the company. You can choose to uninstall the app and stop using it to prevent new data from being collected.
Additionally, with future free apps it is wise to look at where the developer is and what happens to the data. An app’s privacy statement will often state what the developer and what it is used for. If a company is based in Europe, then the developer must comply with strict privacy laws, which means you can always request that your data be deleted.
