Privacy: Can You Trust FaceApp With Your Face?

FaceApp is an app that can edit photos of people's faces to show younger or older versions of themselves.  The fashionable smartphone software used to simulate the effects of ageing on its users' features is at the centre of a global cybersecurity row with majors concerns expressed over its terms and conditions. 

Thousands of people are sharing the results of their own experiments with the app on social media. While such clauses are not dissimilar to those used by other social media firms, the company’s Russian background stoked fears it could be vulnerable to abuse. 

They argue that the company takes a cavalier approach to users' data - but FaceApp said in a statement most images were deleted from its servers within 48 hours of being uploaded. The company also said it only ever uploaded photos that users selected for editing and not additional images.

What is FaceApp?
FaceApp is not new. It first hit the headlines two years ago with its "ethnicity filters". These  transform faces of one ethnicity into another - a feature that sparked a backlash and was soon dropped. The app can, however, turn blank or grumpy expressions into smiling one and it can manipulate styles of make-up. This is done with the help of artificial intelligence (AI). An algorithm takes the input picture of your face and adjusts it based on other imagery.

So what's the problem?
Eyebrows were raised lately when app developer Joshua Nozzi tweeted that FaceApp was uploading troves of photos from people's smartphones without asking permission, however, a French cyber-security researcher who uses the pseudonym Elliot Alderson investigated Mr Nozzi's claims , finding that no such bulk uploading was going on - FaceApp was only taking the specific photos users decided to submit. FaceApp confirmed to BBC reporters that only the user-submitted photo is uploaded.

Other researchers have speculated that FaceApp may use data gathered from user photos to train facial recognition algorithms. This can be done even after the photos themselves are deleted because measurements of features on a person's face can be extracted and used for such purposes. Some question why FaceApp needs to upload photos at all when the app could in theory just process images locally on smartphones rather than send them to the cloud.

In FaceApp's case, the server that stores user photos is located in the US. FaceApp itself is a Russian company with offices in St Petersburg. From a business perspective, hiding the photo processing code in their server makes it hard for potential competitors from copying. It also makes piracy harder

Before using FaceApp for taking our photos of your own, its worth reading FaceApp's privacy policy which suggests some user data may be tracked for the purposes of targeting ads. The app also embeds Google Admob, which serves Google ads to users.

FaceApp's CEO, Yaroslav Goncharov told the BBC that  terms in FaceApp's privacy policy were generic and denies that the company shares any data for ad-targeting purposes, as the business model is to make money from paid subscriptions for premium features.

What else does FaceApp have to say?
Mr Goncharov shared a company statement that said FaceApp only uploads photos selected by users for editing. "We never transfer any other images," he said in a  statement.

"We might store an uploaded photo in the cloud....The main reason for that is performance and traffic: we want to make sure that the user doesn't upload the photo repeatedly for every edit operation....Most images are deleted from our servers within 48 hours from the upload date."

The statement said that while FaceApp accepts requests from users to have their data deleted, the company's support team was currently "overloaded". FaceApp advises users to submit such requests through settings, support, "report a bug" and add "privacy" in the subject line. User data was not transferred to Russia, the statement added.

The UK's Information Commissioner's Office (ICO) told BBC News it was aware of stories raising concerns about FaceApp and that it would be considering them.

"We would advise people signing up to any app to check what will happen to their personal information and not to provide any personal details until they are clear about how they will be used," a spokeswoman for the ICO said.

BBC:       Telegraph:        CNET:

You Might Also Read: 

Limit The Duration Google Holds Your Data:

Get Ready For ePrivacy Regulation:

 

 

« Russian FSB Hacked: "Largest data breach in its history"
Business Leaders Are Ignoring Cyber Risks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Cyber Aware

Cyber Aware

Cyber Aware aims to drive behaviour change amongst small businesses and individuals, so that they adopt simple secure online behaviours.

Westminster eForum

Westminster eForum

Wesrtminster eForum runs a series of conferences on matters relating to the UKs Digital Strategy. Topics include Smart Cities and Cyber Security.

TrustArc

TrustArc

TrustArc provide privacy compliance and risk management with integrated technology, consulting and TRUSTe certification solutions – addressing all phases of privacy program management.

Torsion Information Security

Torsion Information Security

Torsion is an innovative information security and compliance engine, which runs either in the cloud or your data centre.

Center for Long-Term Cybersecurity (CLTC)

Center for Long-Term Cybersecurity (CLTC)

The Center for Long-Term Cybersecurity is developing and shaping cybersecurity research and practice based on a long-term vision of the internet and its future.

CryptoCurrency Certification Consortium (C4)

CryptoCurrency Certification Consortium (C4)

The CryptoCurrency Certification Consortium is a non-profit organization that provides certifications to professionals who perform cryptocurrency-related services.

TwoThreeFour

TwoThreeFour

ThreeTwoFour provide tailored cyber security solutions, delivered by highly-skilled, experienced consultants who respond to the real needs of you and your business.

Valimail

Valimail

Valimail delivers the only complete, cloud-native platform for validating and authenticating sender identity to stop phishing, protect and amplify brands, and ensure compliance.

Halogen Group

Halogen Group

Halogen Group is the leading Security Solutions Provider in West Africa. Services encompass Physical Security, Electronic Security, Virtual & Cyber Security, Risk Assessments and Training.

FoxPointe Solutions

FoxPointe Solutions

FoxPointe Solutions is a full-service cyber risk management and compliance firm.

DataProof Communications

DataProof Communications

DataProof Communications is Cybersecurity Company specialising in cybersecurity operations, incident management and response best practices and technologies.

AKIPS

AKIPS

AKIPS develops the world's most scalable network and infrastructure monitoring software, delivered as a turn-key software appliance.

Ampsight

Ampsight

Ampsight specializes in enabling cloud integration, securing data, and navigating complications that drive critical-mission success.

Driven Technologies

Driven Technologies

Driven is a cloud native service provider transforming the way companies leverage technology to improve business by securing, modernizing, and connecting applications, users, and data.

Twilio

Twilio

Twilio are the customer layer for the internet, powering the most engaging interactions companies build for their customers. We provide simple tools that solve hard problems.

SpectrumWise

SpectrumWise

SpectrumWise is a business technology specialist that provides Managed Services and Managed Security for small and medium IT Networks.