A startup marketing firm based in San Francisco, California, appears to have been secretly saving millions of Instagram users’ “stories,” as well as tracking their locations. The Facebook-owned app has since issued a cease and desist letter to its trusted “marketing partner,” but the incident has revived concerns over Facebook’s apparent inability to protect its users’ data.
Instagram’s lax oversight practices and configuration errors have resulted in allowing one of its vetted advertising partners, Hyp3r, to track millions of users’ physical locations and secretly saving their Instagram “stories,” according to a report by Business Insider.
The marketing firm has reportedly been scraping huge amounts of data to build up detailed records of users’ movements, physical whereabouts, personal interests, and Instagram “stories,” which are photos and videos that were intended to vanish after 24 hours of being posted.
The report added that the situation had been in “a clear violation of Instagram’s rules,” yet was allowed to continue for the past year, as Instagram had vetted the firm as one of its trusted “marketing partners.”
The social media platform has since issued Hyp3r a cease and desist, as well as kicked the firm off its platform, and made changes to its platform in an attempt to protect user data, reports Business Insider.
“HYP3R’s actions were not sanctioned and violate our policies,” said an Instagram spokesperson. “As a result, we’ve removed them from our platform. We’ve also made a product change that should help prevent other companies from scraping public location pages in this way.”
As for Hyp3er, the marketing firm has reportedly denied breaking Instagram’s rules.
“HYP3R is, and has always been, a company that enables authentic, delightful marketing that is compliant with consumer privacy regulations and social network Terms of Services,” said Hyp3er CEO Carlos Garcia in an emailed statement to Business Insider.
“We do not view any content or information that cannot be accessed publicly by everyone online,” added Garcia.
One former Hyp3r employee said they believe Instagram is being “hypocritical,” adding that it takes very little effort for the social media platform to protect location data from being accessed by one of its trusted partners.
“For [Instagram] to leave these endpoints open and let people get to this in a back channel sort of way, I thought was kind of hypocritical,” said the former Hyp3r employee. “Why they haven’t done it remains a mystery.”
You can follow Alana Mastrangelo on Twitter at @ARmastrangelo, on Parler at @alana, and on Instagram.
COMMENTS
Please let us know if you're having issues with commenting.