FaceApp's rise to viral popularity happened quickly, but not quietly. Images of celebrities and civilians, seemingly aged far beyond their years, saturated social media feeds and broadcast news programs within just a few days. We even got in on the fun.
The old face filter we tested is not really a filter; it's an artificial intelligence photo-altering feature that can morph any face into what the countenance might resemble in the future. The process can also conjure realistic images of what a face might look like with a different hairdo, glasses or a goatee. FaceApp achieves these renders by processing the unique details of your face. As such, it's no wonder that skeptical users did some digging into what the app may be doing with their data.
What does FaceApp do with my photos?
The app’s user agreement policy, now at the center of some controversy, states that FaceApp may collect your images, likeness and name, and use them for any purpose, in any country, at the company's discretion. Consider a red flag raised.
It gets stickier, though. One Twitter user, Elizabeth Potts Weinstein, shared a series of tweets highlighting FaceApp's glaring security shortcomings. They include a screenshot from the user agreement and the Saint Petersburg, Russia address listed in the app's terms.
If you use #FaceApp you are giving them a license to use your photos, your name, your username, and your likeness for any purpose including commercial purposes (like on a billboard or internet ad) -- see their Terms: https://t.co/e0sTgzowoN pic.twitter.com/XzYxRdXZ9qJuly 17, 2019
Most social media companies share the policy that if you share content to their platforms, they can use it for promotional purposes. However, FaceApp creates greater concern with its potential to access your device's camera roll. Joshua Nozzi, a developer, tweeted that FaceApp may attempt to upload other pictures from your library to its servers, perpetuating a privacy panic attack. He since deleted the tweet and issued an apology for raising alarm on the internet.
"I was wrong about what I thought the app was doing (uploading all pics once granted access), and I was wrong to have posted the accusation without testing it first," Nozzi wrote.
Nozzi's warning to be careful with this app and other "fad apps" is still just. It was simply the correlation between the app's Russian developers and its alleged stealing of data that made users concerned whether using the app is safe or not.
Is FaceApp safe?
The short answer is no — with a "but." FaceApp is not any safer than the other apps you're probably using every day. FaceApp isn’t doing anything suspicious in its code or its network traffic, so if you’re worried about FaceApp, know that there are a dozen other apps on your phone or tablet doing the same kind of data-mining.
As for how Russia plays into this chaos, it doesn't seem to be involved nearly as much as people feared. Forbes found that most of FaceApp's servers are based in U.S. Amazon data centers, not Russian ones. Although the primary developer has a Saint Petersburg address, Russian intelligence or police agencies would have a considerably harder time demanding user data from Amazon in the U.S.
Still, the FaceApp conversation draws attention to tech tendencies that may make people more vulnerable than they realize. For example: Folks have a tendency to grant any ol' app access to camera rolls, Facebook accounts or calendars.
FaceApp Copycats
Perhaps a greater security threat than FaceApp are malicious FaceApp look-a-likes. If you search ‘FaceApp’ on Google Play now, you can see a number of download options that resemble the original. According to Oslo-based security company Promon, these fakes more often than not contain malicious software and piggyback off the success and popularity of the app they are copying.
“Despite being fun, viral apps like FaceApp open the door for a whole host of cyber security risks," said Promon founder Tom Lysemose Hansen. "Users must be aware in the coming weeks that plenty of malicious copycats, which masquerade as the original FaceApp, will be available to download for free on App Store and Google Play."
Bottom line
If you downloaded FaceApp to make yourself look old, don’t give it access to your photos when it asks; and if you do give it access by accident, you can remove its permissions within your smartphone's settings. When you're done old-ifying yourself, consider deleting the app and requesting that FaceApp delete your data.
In a statement to TechCrunch, FaceApp said it accepts such requests. The FaceApp team is “overloaded” at the moment, but users can send the request through Setting > Support > Report a bug, and write the word “privacy” in the subject line.
Of course, we can't know if FaceApp actually destroys the photo's metadata, but it’s worth noting that we consciously and voluntarily upload images of our faces to other companies’ servers all the time.
