As FaceApp Goes Viral, So Do Concerns About Privacy, Russia Ties

Just as quickly as a free photo-editing app went viral among smartphones users this week, it drew a backlash that exposed growing concerns about digital privacy and the potential for abuse from overseas actors.

FaceApp, which was developed in Russia and lets users upload photos of people’s faces that they can then alter to appear older or younger, saw a spike in popularity this week. The surge was driven by such celebrities as LeBron James and the Jonas brothers posting images on social media of what they might look like decades in the future.

Launched in 2017, the app has been downloaded more than 95 million times world-wide, with more than 20 million of those downloads occurring since July 11, according to estimates from Sensor Tower Inc., a mobile analytics firm. It is most popular in India, followed by the U.S., and is currently the No. 1 downloaded iPhone app in all but one of the 84 markets the firm tracks.

Yet privacy concerns about FaceApp are also widespread, even if some experts said they were slightly overstated. The Democratic National Committee and Senate Minority Leader Chuck Schumer issued warnings about the app Wednesday, saying users could be vulnerable to privacy violations because of its vague terms of service. Mr. Schumer urged the Federal Bureau of Investigation and the Federal Trade Commission to investigate the app for potential national security issues because the developer lists a St. Petersburg mailing address on its website.

Russia-related security concerns are especially acute for the DNC. Its emails were hacked and leaked online during the 2016 presidential campaign by Russian operatives, according to the U.S. intelligence community and the findings of former special counsel Robert Mueller’s investigation into the matter, which characterized Moscow’s interference as “sweeping and systematic.”

Congressional hearings held earlier this week revisited Russia’s influence on the 2016 race through misinformation disseminated on Facebook Inc.’s social-media platforms. And in recent months, some 2020 presidential candidates have reported attempted cyberattacks by Russian actors.

FaceApp is raising alarms in particular because it is encouraging people to share information that companies or individuals typically find difficult to obtain quickly on a large scale, said Micah Hoffman, principal investigator at Spotlight Infosec LLC, a cybersecurity and open-source intelligence firm in Rockville, Md.

“It’s about ease of access,” he said. “People are pushing their data willingly to the app’s owner, instead of the app owner having to scour the internet and retrieve images from multiple sources.”

At least some of the concerns appear overblown: Some critics on social media early this week warned that the app could access the photo libraries of users, but experts said that didn’t appear to be the case.

The fears are fueled by a combination of the app’s expansive terms of service and its ownership by the St. Petersburg-based Wireless Lab OOO. A man who identified himself as FaceApp’s founder, Yaroslav Goncharov, said in a statement that the company doesn’t sell or share data with third parties, and that all user data collected is stored in cloud servers and not transferred to Russia. The app works by uploading photos to servers run by Amazon.com Inc. and Alphabet Inc. ’s Google, and the company deletes most images from its servers within 48 hours, Mr. Goncharov said.

According to its terms of service, FaceApp retains a “perpetual, irrevocable, nonexclusive, royalty-free [and] worldwide” license to share a user’s photos and “any name, username or likeness provided” in broad and unspecified ways. The terms also state the company may share data with a government if issued a subpoena, court order or search warrant or if the company believes the request being made is lawful and in good faith. The app’s terms also say users consent to the transfer and storage of data to the U.S. and other countries “where you may not have the same rights and protections as you do under local law.”

Many of these stipulations can be found in hundreds of other apps from the U.S. and elsewhere, security and privacy experts said. Still, experts advised caution.

“Your facial image is the most sensitive biometric that exists, and by placing your facial image on this program, you’re placing yourself at risk of identity theft,” said Ann Cavoukian, executive director of Global Privacy and Security by Design Center, and former privacy commissioner of Ontario. “In this instance, there’s zero security, zero privacy.”

-Dustin Volz contributed to this article.

By Sarah E. Needleman