If I have used FaceApp, should I be concerned?

This question was answered on July 18, 2019. Much of the information contained herein may have changed since posting.

FaceApp, which allows you to use AI to age a picture of yourself amongst other options, has become a viral sensation that has been fueled by the #FaceAppChallenge hashtag on social media.

If the app developers, Wireless Lab, were not based in Russia (St. Petersburg), the current privacy firestorm surrounding the app would likely never have happened.

What We Know
The CEO of FaceApp, Yaroslav Goncharov, studied computer science at St. Petersburg State University and eventually got a job with Microsoft in Redmond, Washington in a technical capacity for several years. His time at Microsoft is what sparked his interest in facial recognition and artificial intelligence and led to him developing FaceApp.

The app was actually launched in 2017 and immediately dealt with negative press surrounding its use of ‘ethnicity filters’ (http://bit.ly/2JVktD0).

In order to process your selfie for any of its features, the app uploads your image to their servers, which are primarily hosted by Amazon here in the US and not in Russia.

The app developer says that images are deleted after 48 hours and that users can request to have all their data deleted.

The process for doing this isn’t very intuitive; you have to go to Settings, then Support and then Report a Bug. Using the word ‘privacy’ in the subject line is how you currently notify them.

Contrary to many reports, the app is not uploading all the images on a user’s camera roll. It only uploads the images that you select in the app to be processed.

Although the app is free, it does offer in-app purchases that range from $1.99 to $39.99 per item. It’s likely that a nefarious Russian government sponsored app would make all the features free to encourage more usage.

The app’s privacy policy is no more onerous than lots of other apps that you’re likely already using every day.

Both Apple and Google have specific requirement for an app to qualify to be posted in their associated stores and FaceApp has not violated any of their terms of use.

What We Don’t Know
We don’t know if information that is being stored on US based servers that supposedly gets deleted within 48 hours is not also being transferred to servers elsewhere during that period.

For that matter, we have no way to verify that they are actually deleting images as they say they do.

A database of 150 million pictures associated with names and other details readily available through social media and your device is pretty valuable, so it’s not hard to understand why so many security and privacy experts are sounding alarms.

Facial recognition technology is developing at a fast pace and we don’t know what the implications of sharing our faces through an app of this type could mean in the future – it’s the classic ‘we don’t know what we don’t know’ problem with technology.

The Bottom Line
If you’re losing sleep over the fact that you used FaceApp, you should be in a full panic for using Facebook, SnapChat, Instagram and lots of other popular apps.

Hopefully the current rage over FaceApp, which is part hysteria and part rational, causes more users to think about any app or service they decide to use in the future.