That Face-Aging App Made by a Russian Company Has an Odd Privacy Policy

You get to be a baby or a senior citizen in exchange for giving your photos away.
Triptych of a man's face made to look older by an app using facial recognition software
Photo by Matt Martin

Aging is suddenly very fashionable thanks to FaceApp, a program that shows users what they look like decades older, or with beards, or as a different gender. It's a more understandable, if less satisfying, social media trend than filling things with beans, and celebrities like Drake and the Jonas brothers have used it to prove that they'll continue to be hot for years to come. But FaceApp also gives access to a massive treasure trove of personal data for the Russian company, Wireless Labs, that developed it.

Despite the viral moment its having right now, FaceApp has been out for two years already, and, like many apps, it's raised privacy concerns. The website TechCrunch consulted with security researchers, and they confirmed that there's no evidence that the app accesses the entire camera roll on users' phones without consent. But because of the design of the app's interface, specifically selecting one photo at a time to upload and alter, FaceApp has access to every individual photo a user has modified, even if the user has adjusted their phone settings to explicitly opt out of sharing photos. So while FaceApp doesn't have access to your entire photo library, it does, according to TechCrunch, save the individual photos you use with the app on to a digital cloud instead of doing on-device processing like other apps.

FaceApp replied to TechCrunch with a statement saying, "Most images are deleted from our servers within 48 hours from the upload date." Notably, they don't say all images are deleted after 48 hours. It adds, "We don’t sell or share any user data with any third parties." According to the app's terms of service, though, users consent to allow the company to use their image, name, username, or voice, "sufficient to indicate the individual's identity." Agreeing to the terms grants FaceApp "perpetual, irrevocable, nonexclusive, royalty-free, worldwide, fully paid, transferable sub-licensable license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, publicly perform and display" users' names and images.

TechCrunch reports that users can have their data removed, but it's a hell of a process:

FaceApp also says users can request their data is deleted. Though it doesn’t yet have a very smooth way to do this — instead it asks users to send delete requests via the mobile app using “Settings->Support->Report a bug” with the word “privacy” in the subject line, adding that it’s “working on a better UI for that”.

So it's really up to users to weigh the pros and cons. On the one hand, you can see what shape your face might be in 30 to 50 years from now without having to wait that long. And on the other, you may end up on an eastern European billboard or indirectly contributing to the rise of facial recognition software.