No, FaceApp Isn’t Sending Your Whole Camera Roll to Putin’s Russia

Everyone from the Jonas Brothers to Shaquille O’Neal has embraced the latest edition of Russia-based face-morphing app FaceApp, which adds wrinkles and eye-bags to selfies to show how users could look decades older. 

But now users who rushed to see how they’ll look near-death are panicking over privacy concerns. FaceApp’s customer service has been overwhelmed by users requesting the company delete their data. And the New York Post claimed Wednesday that using FaceApp means “Russians now own all your old photos.” 

The FaceApp photo boom, dubbed the #AgeChallenge, has been accompanied by a series of wild accusations about the app this week. The social media claims have alleged that FaceApp users have accidentally handed over their photos for use by Russian artificial intelligence, or have been secretly spied on through the app.

According to security researchers and privacy experts, though, FaceApp’s privacy terms are bad, but they’re not unusual. 

“Their privacy policy is bad, but this is common,” French security researcher Robert Baptiste told The Daily Beast over Twitter direct messages. “It's not a good thing, but this is not unusual.”

The most overblown concerns about FaceApp kicked off late on Monday night, when software developer Joshua Nozzi claimed that the app uploaded every phone on a user’s phone camera roll, rather than just the photo that was selected for age-morphing.  

"BE CAREFUL WITH FACEAPP—the face aging add app,” Nozzi tweeted. “It immediately uploads your photos without asking, whether you chose one or not.” 

Baptiste investigated the claim that FaceApp uploads a user’s entire camera roll and found no evidence that the app uploads all of a user's pictures. Judging by the app’s traffic, according to security researcher Ivan Rodriguez, FaceApp only uploads the photo the user wants to change. Nozzi has since apologized for his claim.

The selected photo is uploaded to Amazon-operated cloud servers—disproving widespread fears that the photos are somehow being used by the Russian government.

Rodriguez, an engineer at Google, tested FaceApp on four different phones running Apple’s iOS operating system and confirmed that FaceApp isn’t uploading entire camera rolls without permission. 

“It’s not uploading your entire library to the cloud,” Rodriguez said. “That’s definitely the first false claim that’s going around.”

Rodriguez thinks FaceApp could make it clear to users that the aging technology is being applied to photos after they’re uploaded to the cloud, rather than being applied on their own devices. But he thinks that’s not uncommon in the world of free apps, where users often don’t consider their privacy when downloading a new app. 

“So far, I haven’t found any real threat, other than you sharing your one image or the ones that you select with them,” Rodriguez said. 

Privacy advocates have also criticized FaceApp’s privacy policy, which give FaceApp wide-ranging rights to users’ images after they upload photos. International privacy group Privacy International warns that using FaceApp will create a “detailed biometric map” of a user’s face, a “highly prized commodity.” That fact hasn't deterred billions of people from sharing huge collections of facial data with companies like Facebook.

“People are right to be alarmed by terms of service like the one FaceApp has—as they should be with similar apps,” Privacy International legal officer Jade Chong-Smith said in a statement.

FaceApp has denied taking photos that haven’t been approved for uploading to the cloud, and said it’s trying to improve the process for deleting information from a server. The company also denied transferring photos to Russia.

Baptiste, the French security researcher, said the privacy issues that have set off a panic about FaceApp should prompt users to practice better care with their privacy issues.

“This app is cool, stars use it, the filters are awesome, but they need to think about their privacy first,” Baptiste said. “Do you know how your photo is used after the upload? They have to realize that their photo is not theirs anymore after the upload.”