Viral FaceApp app ‘could let strangers have control of your photos FOREVER’, experts warn
VIRAL photo-editing app FaceApp could put your photos in the hands of complete strangers forever, experts have told The Sun.
Cybersecurity officials are now warning Brits to be cautious when they use the app – which uses AI to make you look older, younger or change your hair colour.
FaceApp was first built in 2017 and immediately went viral, but is now popular once again.
It's all thanks to a new feature that automatically edits your selfies to convincingly make you look much older.
But experts say that the app's Russian creators have too much control over the photos on your phone.
"The implications on privacy for apps like FaceApp is extremely concerning," said KnowBe4 security expert Javvad Malik, speaking to The Sun.
To use the app, you need to grant permission for FaceApp to access your photos.
Then you can upload individual selfies that you want to edit.
But security experts have warned that the app's terms and conditions (which aren't visible inside the app) give creators rights to your photos forever.
'Overly aggressive terms and conditions'
One clause reads: "You grant FaceApp a perpetual, irrevocable, nonexclusive, royalty-free, worldwide, fully-paid, transferable sub-licensable license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, publicly perform and display your User Content and any name, username or likeness provided in connection with your User Content in all media formats and channels now known or later developed, without compensation to you."
It means FaceApp's creators can keep your photos on file indefinitely, edit them, use them in promotional materials, and even sell them without compensation.
The app can also hand your photos over to third-parties – complete strangers who you've never even interacted with.
It sounds terrifying, but Tripwire's Tim Erlin told us that it's not surprising for FaceApp to take full advantage of users.
"Overreaching terms of service are not a new phenomenon. In most cases, they’re written by lawyers who are tasked with protecting the company, not the consumer," the security expert revealed.
"It’s no surprise that terms of service are heavily skewed toward that end.
"The percentage of people who make a decision not to use an app because of the terms of service is very small.
"There’s no downside for an app publisher to be overly aggressive in what rights they claim in their terms.
"Until the terms become relevant to the apps adoption, we can expect more of the same."
Accessing photos despite 'Never' permission
There are also concerns about how the app can collect photos without actually having permission to access the Photos gallery on iPhone.
With iPhone, it's possible to deny Photos access for apps individually.
But if you set FaceApp to 'Never' for accessing your Photos app, it's still possible to upload photos.
FaceApp warning – expert reveals the risks of handing over your photos
Here's what cybersecurity expert Tim Mackey, of Synopsys, told The Sun...
- "Users of AI enabled applications like FaceApp likely aren’t aware that the AI actions taken by the app will occur on servers owned and managed by the app authors.
- "This means that whatever data provided will be available to them, for whatever use, for as long as they want.
- "It is the potential for this unbounded activity which requires users to be vigilant and ensure the privacy policy includes clear statements surrounding what data was used, where it is being processed and by what organization, and for how long the original and derivative works are retained.
- "In the case of FaceApp we also need to look at the question of image copyright and the nature of their service.
- "When a photo is taken, the photographer owns the copyright to the resulting image.
- "They can license that image and absent a license, most jurisdictions have strict guidelines on how an image can be used.
- "Additionally, if the image is of a person, the photographer should have obtained a release from all people in the image.
- "When combined the license and releases provide the legal framework for how images can be used in specific contexts.
- "While much of the coverage of FaceApp’s recent surge in popularity has centred around privacy concerns, the reality is any image uploaded to FaceApp is being transferred to a third party absent a license and modified versions of the uploaded image are then returned.
- "The FaceApp Privacy Policy doesn’t help matters as it simply states that User Content is available to any company in the group of companies FaceApp is part of – without defining this group.
- "All of this should raise alarms whenever a free service is acting on sensitive information like images – the revenue to pay for the service is coming from somewhere and it’s likely the sale of data related to what the service provides."
It's worth noting that this isn't a flaw with FaceApp itself, but is actually part of Apple's iPhone design.
The ability for apps to still take individual photos from your camera roll with your permission – even if the app itself doesn't have overall permission to access photos – was added as part of 2017's iOS 11 update.
That's because you're showing intent by tapping a single image to upload.
And it's actually useful design, because you can still use the app to upload individual photos without giving the app access to your entire photo library.
We recommend turning this feature on: Go to Settings > FaceApp > Photos > Never.
'Embarrassment and blackmail'
The app has also sparked fears of non-consensual photo-editing.
Recent years have seen terrifying apps like DeepFake and DeepNude that can take innocent selfies and turn them into pornographic photos and videos.
One expert told The Sun that the app could be used for similarly "nefarious" means – embarrassing people publicly.
"The app itself uses AI to digitally age users’ photos, which is fun from a novelty perspective," cybersecurity expert Javvad told us.
"But the same types of AI is used to produce deepfake type of imagery which can be used for nefarious purposes such as public embarrassment or blackmail."
We've asked FaceApp for comment on why it needs such broad terms and conditions and for more details on how photos are stored, and will update this story with any response.
MOST READ IN TECH
Last year, The Sun reported on how online pervs were using a computer app called "deepfakes" to create fake porn videos.
Users simply needed to feed the app hundreds of photos of a celeb's face – and an XXX film – and then sit back and wait for an algorithm to create a convincing sex tape using the images.
The Sun also revealed how sickos were using childhood photos of actress Emma Watson to create fake sex tapes.
Do you feel safe using FaceApp? Let us know in the comments!
We pay for your stories! Do you have a story for The Sun Online news team? Email us at [email protected] or call 0207 782 4368 . We pay for videos too. Click here to upload yours.