Over the past week, I've noticed multiple people on Instagram post about an update to their terms of service that allows Instagram massive new access to your data. Several of my friends also sent me the update to ask my opinion. In this article, I will explain what Instagram is tracking about you and how you can limit their ability to access your information.
Table of Contents
Data Policy
I started by pulling up Instagram's Data Policy, which lists all the data Instagram collects and which includes Instagram, Facebook, Messenger, and other apps owned by Facebook. I've written out a list of many types of information collected and tried to give a simple explanation for each one. While it is very long, I decided to exclude a few smaller items for clarity's sake. The list itself can be split into roughly three catagories:
Information you give Instagram
All of this information can be summed up by the statement "If you do something inside the Instagram app, Instagram can see it." All of this information (including information from the camera) is analyzed by Instagram's automatic systems.
- Any information you enter when you sign up (email address, name, username, etc.)
- Anything you post, including photos, captions, comments, and other information attached to your photos. For instance, if your phone saves the location where photos are taken and you post a photo, Instagram will also be able to see where the photo was taken.
- If you follow other accounts or hashtags, Instagram can see who you follow and who follows you.
- Your likes and searches. Instagram can see which posts and comments you have liked and what you've searched for on Instagram.
- If you use the Instagram camera to post Stories or Reels, Instagram can see what you point the camera at. While the camera is open, everything seen through the camera is analyzed to suggest filters and masks. Note that in this context, "masks" refer to face overlays in the camera, not physical face coverings.
- Any messages you send through Instagram. If you use the messages feature of Instagram, they can see the content of every message and who you are communicating with.
- Credit/debit card information, billing, shipping, and contact information. If you purchase anything through Instagram or use it for any other financial transaction such as a donation, Instagram collects information about the purchase. This includes your credit/debit card information, shipping and billing information including addresses, as well as "other account and authentication information".
Information collected that you can control
Instagram also collects some information from your system when you give it permission. These features can usually be disabled by revoking access on your devices. Such information collected includes:
- Contacts on your device. If you enable Contact Uploading, Instagram periodically reads and stores a copy of all your contacts.
- GPS location. If you enable location access, Instagram can track your precise location. Note that Instagram can still collect general location information from other sources on your device if GPS permission is denied.
- Device Settings. Instagram reports which permissions you have granted to Instagram, such as whether you have enabled GPS location, or camera and photos access.
A note on SMS messages and call history
Instagram's Data Policy says it can collect the text messages you send through SMS. To my knowledge, Instagram does not request permission to access this and therefore does not collect it. Because Instagram shares its data policy with Facebook and Facebook Messenger, I believe this statement in Instagram's data policy is referring to features that exist within Facebook Messenger.
Information collected that you cannot control
This is information that is collected by Instagram automatically and is difficult or impossible to prevent. Such information includes:
- When you use Instagram. Every time you open Instagram, the time is recorded as well as how long you spend there.
- What you view on Instagram. Instagram observes every post and video you see on their platform and measures how you interact with it, including things such as how long you looked at it and if you liked or shared it.
- Who and what you interact with on Instagram. When you message or otherwise interact with another user or page, Instagram tracks how you interact with them and how much time you spend interacting with them.
- Any information about you provided by other users. When other users interact with you on Instagram, tag you in photos, or upload your contact information, Instagram links this information to you.
- Information about your device. Instagram collects a lot of information about your devices like what kind of device it is, its battery level, and how much storage space is available.
- Your mouse movements within Instagram. If you load Instagram in a web browser, Instagram watches and records your mouse movements within Instagram.
- Device ID numbers. Instagram collects different ID numbers on your devices that identify both you and your specific devices. This allows them to track you even if you've logged out of your account and associate all your devices with you.
- Signal data. Instagram collects information about the way you connect to other devices from Bluetooth signal strength and information provided by nearby WiFi and cell towers.
- How you connect to the internet. Instagram collects information such as your phone number, IP address, and other information about how you connect to the internet.
- Other nearby devices. In some cases, Instagram can collect information about other devices around you or connected to the same WiFi network. This lets Instagram collect data about devices that are not connected to Instagram, and can be used to detect other Instagram users close by.
- Other websites you visit. Many websites include code from Facebook or Instagram. If you visit any of these websites, Facebook/Instagram can see you've visited that website. Many websites go further, reporting what you did while you were on their site.
- Other things you do. Businesses that have Facebook or Instagram pages can upload information about what you do with their business to Facebook and Instagram. This includes both online and businesses with physical locations.
Privacy Implications
Obviously this is an incredible amount of information. With all of this, Instagram has the ability to track you both on the internet and in real life, as well as build an algorithm that can determine your identity online even if you're not logged into Instagram. By tracking these patterns, Instagram has an intimate model of how you behave online and what kind of person you are.
To make this even worse, Instagram is owned by Facebook, and all the information above is shared between the two. Facebook, Instagram, and Facebook Messenger all collect similar data, allowing them to watch you and your interactions very closely.
One other thing that's important to mention is that Instagram has collected this information for years. Instagram's Data Policy hasn't been meaningfully changed since April 2018, and many of the provisions laid out in the policy haven't changed since 2013. (Here's the archived 2013 version of Instagram's Privacy Policy.) I am thrilled that people are becoming aware of how Instagram collects information about users, but I think it's important to note that none of this is new in the December 2020 Privacy Policy update as some have mistakenly claimed.
If you're curious about seeing the information Instagram has on you, you're in luck — Instagram lets you see some of what it's collected. On mobile, open Settings in Instagram and tap on "Security". Under "Data and History", tap "Access Data". Go ahead and scroll through all the categories and see what's in there. Pay special attention to "Ad Interests" at the very bottom, which is a list of everything Instagram thinks you're interested in. When I checked, Instagram had given me more than 400 interests.
You can also view your data here.
Protecting Yourself
At the end of the day, if you use Instagram, there's no way to completely avoid being tracked. An increasing number of people are uncomfortable with that fact, and that's awesome. Protecting your privacy is one of the most important things you can do online. However, not all of us have the luxury of being able to completely abandon social media, and many more find a lot of value in the services Instagram provide.
If you don't want to get rid of Instagram completely, there are steps you can take to limit the information Instagram can collect.
Disabling location access forbids Instagram from accessing your precise GPS location. It will still be able to access your general location based on your IP address, WiFi access point location, and other sources.
Disabling access to your contacts prevents Instagram from uploading and storing information about your friends, family, and other contacts. Instagram will still be able to track your relationships on the Instagram platform.
iOS
Follow this guide to change app permissions on your iPhone. Deny permissions for Location and Contacts. If you don't use the Instagram camera, you can also disable Camera and Microphone permissions.
Android
Follow this help article to change app permissions on your phone. Deny permissions for Location, Contacts, and Phone. If you do not use the Instagram camera, you can also deny Microphone and Camera permissions. You also have the option to allow Instagram to ask for permission every time they want to access any of these by setting their permissions to Ask Every Time.
Additional Steps
Leaking Photo Location
As noted above, if your phone's camera stores locations along with your photos, Instagram has access to the location where any photo shared on its platform was taken. In order to prevent this, deny location permissions to both Instagram and the camera app.
Deleting Contacts
After you've disabled Contacts permissions, delete your uploaded contacts from Instagram using this tool.
The Next Level
Disabling permissions is a start, but in order to prevent Instagram from tracking your devices and what you do on the internet, you need to go a step further.
In order to prevent Instagram from tracking your device information and nearby devices, use the Instagram website instead of the app. Since web apps are much more locked down than traditional apps, Instagram doesn't have access to your device's information or your nearby devices. You can install the Instagram site as a web app on your phone's home screen by following this guide.
To stop Instagram from tracking you across the internet, you need to install an ad blocker. These addons block small pieces of code Instagram has placed inside many websites that tell Instagram you've visited that website. My two favorite ad blockers are Adblock Plus and uBlock Origin, and they are available for all major desktop and some mobile browsers. In order to protect you from this tracking entirely, make sure you have an ad blocker on both your computer and phone.
Taking these steps significantly reduces the amount of information Instagram collects about you outside of Instagram. These extra steps are perfect for people who are serious about privacy but aren't able to completely quit social media.
In Review
Instagram collects a massive amount of data on its users, both on and off its platform. A few simple steps will greatly help you improve your privacy with Instagram. Limiting the app's permissions on your phone, using the Instagram web app, and installing an ad blocker will all help to limit the amount of information Instagram is able to track about you.
If you are interested in further increasing your privacy, DuckDuckGo has published a series of articles on protecting your privacy on all your devices. You can read the articles here.