Face-Swapping Apps: Understand the Risks and Stay Safe

In recent years, AI face-swapping apps, also known as “deep fake” apps have become hugely popular. Users can swap out their face with a celebrity, put their face in a premade video, or swap faces with friends. While these apps were created for harmless fun, they’ve raised many concerns about data privacy, spreading disinformation, and likeness theft.

If you use a face swapping app or are interested in using one, you should know exactly what you’re getting into. Let’s go through the dangers of deep fake apps and what you can do to protect your personal data while using them.

What data do face-swapping apps collect?

When you want to know how face-swapping apps — or any apps for that matter — use your personal data, start with the terms of service and privacy policy. You probably agree to terms of service and privacy policies when signing up for apps and accounts all the time without reading them.

Sure, it’s more convenient, but you should stop doing that. It’s always good to glance over these policies before signing up and agreeing to give your data away.

VPN Overview analyzed the privacy policies of the 40 most-downloaded face transforming apps on the Google Play Store and App Store. The analysis included aging apps, gender-swapping apps, beautifying apps, face-swap apps, and body-editing apps.

The study from VPN Overview identified eight data points that these apps most commonly collect:

Phone contacts
Credit/debit card information
Device camera and photo gallery access
Information from linked social media accounts that are public
Exact user location
All content generated using the app
Personally identifiable information (PII) like first and last name, address, and phone number
Usage data such as which features a user accesses and how many times they use the app

A big issue that has made headlines in the last few years is photo retention. Many people wonder what these apps do with photos of your face after they’re processed, or how long they hold onto them. The VPN Overview study found that most face transforming apps get rid of your pictures after they’re processed, allegedly.

Not every face swapping app collects all the data listed above, but some do. Most collect more than they need to provide their services. Why does an app need to know your exact location to tell you what you’ll look like in 50 years?

Popular face-swapping apps that have raised privacy concerns

In the last few years, many face-transforming apps have made news over personal data security.

FaceApp: In 2019, there was an uproar over the Russian app FaceApp when a user revealed that the app claimed a license to use users’ photos, names, usernames, and likeness for any purpose, including commercial purposes. At the end of 2019, the FBI issued a warning against the app.
ZAO: ZAO went through similar controversy as FaceApp, also in 2019. The Chinese app ZAO’s user agreement gave it total and permanent rights to repurpose user-generated content as it saw fit.
Reface: Reface (originally released as Doublicat in 2020 by a Ukrainian developer) came under fire for the same reasons as FaceApp and ZAO, granting itself a permanent license to use user photos. Reface has since stated it deletes uploaded photos from its Google Cloud platform within one hour of being uploaded.

What can you do to protect your privacy?

The best way to keep face-transforming apps from collecting and retaining your data is simply not to use them. But there are ways to remain safe if you do choose to use one of these apps. Additionally, be mindful of sim swapping issues, as hackers can exploit your phone number to gain access to your accounts, including those linked to face-swapping apps.

Be careful about what you download

Check that the app comes from a reputable developer. Look at the developer’s name and do a quick Internet search to see what comes up. Only download apps from official sources like the Google Play Store or the App Store. Also, check the app release date and user reviews. You can typically trust apps that have been around longer and have gone through several bug fixes, as well as apps with a mix of positive and negative reviews.

Read the terms of service and app permissions

Before you download anything or create an account, read the terms of service and privacy policy. The app should provide a link to read these documents before you sign up but if not, find them online.

Don’t allow face-swapping apps access to your social media

As a rule, you should prevent apps and services from accessing your social media accounts. When they ask you to sign in with Facebook, Twitter, or another profile, just sign up with an email address instead. The same goes for face-swapping apps. Protect your personal information on your social media account by keeping your profile private, and don’t allow an app to post or share to your profile.

Keep your device OS up to date

A good cybersecurity habit to get into is to always keep your device and apps updated. Check regularly for software updates or set up reminders for when new versions are available. Updates usually patch bugs or vulnerabilities in apps, so if you neglect to get the latest version, you put yourself at risk.

Being careful with face swapping apps

Many people worry about face-swapping apps holding onto photos of them or using their likenesses for commercial purposes. But these apps collect much more data from you than your face, and it’s important to keep that in mind the next time you want to use one. Follow these tips and keep yourself safe!