Last week, photo-editing app FaceApp went viral as people flocked to its aging feature. Faux-elderly photos of celebrities spread on social media, and it became the top free app in Apple’s App Store.
But privacy concerns quickly grew around the app’s terms of service. Anyone who agreed to the terms gave FaceApp access to their photos, name and likeness.
A section of the terms said users grant the company “irrevocable” access to “use, reproduce, modify, adapt, publish … distribute” any name, username or likeness provided.
Its viral success showed how little people scrutinize companies’ terms and conditions or privacy policies before giving them access to sensitive information. The issue is hardly limited to FaceApp: Users of services including Facebook (FB), Google (GOOG) and Amazon (AMZN) often agree to similar terms without reading them.
If a company says it owns your data and you agreed to their terms, and their terms hold up, then they own your data, according to Melissa Brekke, an attorney at Gunderson Dettmer who drafts and reads these policies regularly.
If you’ve downloaded an app or visited a website and are concerned about your personal information, there are steps you can take to try to revoke access to it.
One step people can take is to submit a formal request to a company to have their info deleted. Not all companies allow people to do this, but even for those that do, it’s not necessarily a straightforward process. For example, FaceApp lets users submit a written request through its app to wipe their records. However, it’s unclear how quickly this occurs. FaceApp did not respond to a request for comment.