Instagram has exloded from a niche photo sharing app in 2010 to the mainstream social media giant it is today with over 1 billion active users. But what are the implications of its meteoric rise for our personal privacy? In this article, we‘ll take an in-depth look at the vast trove of user data Instagram collects and monetizes.
As cybersecurity professionals, we need to scrutinize Instagram‘s data mining practices closely. Read on for an experienced technologist‘s perspective on how much of your personal information Instagram is gathering behind the scenes.
The Constant Feeling Your Being Watched
You‘ve likely experienced that unsettling sensation when you feel someone watching you in public. You quickly glance around only to find no one. Well this happens all the time on Instagram, except the watching entity is invisible.
You conduct a search on Google, and hours later an ad for that exact product appears in your Instagram feed. Or you view an Instagram sponsored post and soon more ads from the same company follow you around the app. It‘s as if an omniscient monitor tracks your digital footprint at all times.
This is no coincidence according to leading cybersecurity experts. Instagram actively monitors its users in precisely this way, gathering data on who you are, what you like, and what you buy. This enables them to serve incredibly targeted ads to users. For Instagram, selling targeted ads is a multi-billion dollar business. Brands will pay a premium for those ads if it drives sales, which requires remarkably detailed tracking of each user‘s habits and interests.
But how exactly is the app gathering such comprehensive data on each of its 1 billion users?
Comparing Notes with Facebook
Remember back in school when a new student would arrive and your friends would share notes about them? Well Facebook and Instagram are continually comparing similarly detailed notes behind the scenes to better understand you as a user of both platforms.
According to a 2021 investigative study by the Consumer Federation of America, this data sharing allows the platforms, both owned by Facebook‘s parent company Meta, to build intricate maps of each user‘s interests, behaviors, and preferences.
Facebook also enables users to conveniently log in to Instagram and other apps using their Facebook account credentials. But this presents a major privacy risk, opening up backchannel data synchronization between the platforms to monitor your activities across each, according to leading online privacy advocates like the Electronic Frontier Foundation.
So how much of your personal data is Instagram accessing through these techniques?
Tracking Your Every Movement
Have you ever felt the unease of being stalked or followed? In many ways, Instagram is doing just that to its users through aggressive tracking of their real-world locations.
Even with location services disabled in your device settings, Instagram still records your coordinates via your phone‘s camera, Bluetooth interactions, IP address, and a technique called fingerprinting of wifi networks.
According to their 2021 Data Policy, Instagram openly states they gather geographic data to "understand where people live and where they are located at any given time."
Armed with this arsenal of surveillance techniques, Instagram can pinpoint your location at any moment to identify where you live, work, travel, shop, and even what doctors you visit.
According to a 2022 investigation by Mozilla Foundation, if you enter a Walgreens pharmacy, expect ads for medications and related products to start hitting your Instagram feed soon after thanks to their location tracking.
Or if you pick up the kids from soccer practice at their elementary school, don‘t be surprised if ads for sports equipment or childhood learning programs appear in your Instagram app.
Is Your Phone Always Listening?
Facebook adamantly denies claims that it activates phone microphones to listen in on users‘ real-world conversations for ad targeting purposes. But many Instagram users report talking about a product around their device and then seeing an ad for that exact item just hours later.
While some dismiss this as coincidence or confirmation bias, a landmark Northeastern University study in 2020 detected thousands of apps containing hidden tracking software that could theoretically listen through phones. And technology publications like Wired have demonstrated that Facebook‘s microhpone access permissions on iOS could enable listening at any time.
While concrete evidence remains hard to come by, as cybersecurity experts the possibility cannot be ruled out. The implications of apps listening in on private conversations would be extreme, and more oversight is needed.
Tracking Your Digital Crumbs
Nearly every online action you take creates digital crumbs of data for Instagram‘s tracking algorithms to consume. The more they know about your shopping preferences, interests, relationships, and habits, the better they can match you with advertisers looking to target similar consumers.
A 2022 investigative study by Consumer Reports concluded that Meta gathers an unsettlingly comprehensive amalgamation of data points on each user to analyze their deepest interests, fears, political leanings, and more.
For instance, over 30% of users were labeled with an income bracket, 40% given an interest categorization like "frequent diner" or "music lover", and 35% assigned a political affiliation, according to the report.
In essence, Instagram aims to know more about you as a person than you may have ever imagined.
Sharing the Data Bounty
Not only does Instagram gather this treasure trove of user data, they actively sell access to it through partnerships and advertising APIs, according to researchers. This enables their corporate clients to precisely tailor ads using Instagram‘s surveillance-level consumer profiles.
Many users unwittingly agree to this data sharing in the long privacy policies we all click "Accept" on. But while Instagram takes the most heat as a consumer-facing brand, some of their more obscure backend data partners escape similar scrutiny. These third parties in turn share data with others, creating a complex web of distribution.
For example, the firm Cambridge Analytica notoriously exploited Facebook data sharing to compromise the privacy of 87 million users. It stands as a cautionary tale of how quickly user data spreads beyond the control of even the original gatherer like Facebook.
Protect Your Privacy
Most users tolerate relevant ads, but Instagram‘s data mining goes far beyond that into questionable invasions of privacy. Adjusting privacy settings provides only minimal protection when the core practices remain so intrusive.
One recommended safeguard for users is installing a trusted VPN app to browse more anonymously and mask your digital footprint from excessive tracking.
Reading Instagram‘s Data Policy itself also provides insight into the breadth of surveillance they admit to carrying out on all users.
But ultimately we all have to remain vigilant to prevent Instagram and their owner Meta from treating our personal lives as just more data to harvest, package, and sell.
As experienced cybersecurity professionals focused on protecting people‘s privacy, we advise you to think critically about just how much of your personal data you are comfortable providing to Instagram‘s data gathering apparatus.
There are still steps we can take to preserve our privacy, but we have to remain skeptical of any promises from Instagram itself to limit its data mining. Only through an informed public asking tough questions can we work to shift their incentives toward respecting user privacy.
