A new California law forced Instagram to hand over my data. It included thousands of messages and photos, but not everything
n the 10 days leading up to Christmas, I searched on Instagram for three of my exes, an acquaintance I met on a trip to Cuba four years ago, an account dedicated to astrology memes, a past roommate, my own dog’s account (@lucythetherapypup), my best friend’s sweater-wearing poodle, a famous Pomeranian who lives in New York, a bird named Parfait I recently met at a San Francisco market, 10 contestants of the reality TV show Love Island, and the hashtag #wienerdog. I know all of this because I Instagram told me.
That’s because this month, I submitted a data request under
California’s new privacy law to see just how much information the company has on me. What I got was a wide-ranging look at how my life has changed in the 10 years since I first logged on to Instagram,and a window into what the company is willing to share about what it knows about me.
California Consumer Privacy Act, I have the right to demand companies disclose “any personal information” they collect about me and request a copy of that information. On 4 January, Instagram sent me 10 folders of data – nearly 8,000 photos, thousands of text files from my direct messages, and search history.
It’s almost certainly not the full collection of information Instagram has gathered on me over the years. “I am 100% sure this is not the only data that Instagram has on you,” said John Ozbay, the chief executive of privacy and security tool Cryptee. “But because we cannot prove they have more, they will never give it to you.”
As the troves of data Instagram and Facebook hold on users increasingly become tools of
election manipulation and subject to data breaches, it’s more important than ever we have a good handle on what these tech giants know about us, Ozbay said, and challenge them to share more.
A data time capsule
On 26 November 2011, I posted my first ever picture to Instagram: a snapshot of my cat drinking water out of a fish tank. The photo got two likes – the app had only been founded one year prior and I had just five followers at the time.
Kari Paul’s first Instagram post on 26 November 2011. Photograph: Kari Paul
Nearly 10 years later, Instagram has become the most-used platform on my phone, where I spend an average of 45 minutes of my life a day interacting with my 824 followers. Instagram was acquired by Facebook in 2012 and has since gone from 5m users to
more than 1bn in 2018. In that time, it began to allow ads, changed the timeline from chronological order to algorithmic, and added new features such as “stories”.
Staring into 10 years of my life, digitized, was daunting. The trove included text files of tens of thousands of direct messages I’ve sent and hundreds of photos I have uploaded, both on the grid and on stories, which launched in November 2016. It spans my time in college in Missouri, studying in Argentina, my 2014 graduation, my first internship in New York, three different jobs, and 10 different apartments I’ve lived in across five cities.
In one photo from 2014 I smile earnestly at the camera from a Brooklyn rooftop, watching my first New York City sunrise a week after moving there at 21. Was anyone ever so young?
The photo archive chronicles a parade of hairstyles, a triumphant picture from my first and only half-marathon, a sad selfie from the hospital after a broken bone, some drunken videos I have no memory of taking, smiling photos of exes. Hundreds of selfies, dozens of pictures of food, and more than a handful of photos that could be described as not safe for work.
When stories were introduced, some sad poems show up, memes about being a Libra, memes about being depressed, rainy videos of the M train going over the Williamsburg Bridge that make me emotional watching them now, rooftop parties I don’t remember, travels to Brazil, Mexico, the Caribbean; four weddings.
Also in the data: receipts for the entirety of my relationship with my current partner, who I met on Instagram. In the archives, a note that I had liked her comment on a personal ad I posted in 2017 and 6,652 messages since I first struck up a conversation. And now, links to apartments I’ve sent her as we look for a place to live together.
Beyond the pictures
Most of this was to be expected. Of course I knew Instagram kept archives of the photos I post.
Other information was slightly more surprising – one file showed how I voted in every Instagram poll on user stories since 2018. Another showed which users I have blocked and how many times I replied to other users’ stories.
The author in Brooklyn in 2014. Photograph: Courtesy of Kari Paul
And, as I mentioned before, Instagram also showed me every search I have made on the platform over the past month, many of whom are people I don’t follow (yes Instagram keeps track of who you are lurking, for up to six months, according to the company). It kept track of my former username and my current username, and every time I had changed the text in my bio.
One file showed how many posts I have saved (1,779) since 2017, when it started this feature, and another showed what I have commented on other accounts and whose comments I have liked.
What the data doesn’t show
Once I shook off the uncanny feeling of staring into a 3.92GB void of memories, I realized how little it told me about what Facebook really knows. The data trove represented more of a benign walk down memory lane rather than a look into the black box of how Facebook’s advertising mechanisms – which
bring it $17.4 b n in quarterly revenue – work.
Images may contain metadata that show where they were located and what the images contain. According to Instagram’s data policy, it may collect usage data, device information and metadata including the location of a photo or the date a file was created. We know that in the past, Instagram has tested sharing precise location data with Facebook, which means it is
collecting that type of information from users.
But none of this was included in the files – and that could be in violation of the CCPA, said Alastair Mactaggart, who co-wrote the privacy ballot measure.The files Instagram sent to me did not include any location data they had gleaned from my app activity, only locations I had manually uploaded to photos using its location tagging feature.
“The text of the law is very clear – everything means everything”, he said. “Anything it gathers about you, it should hand over, and there isn’t a lot of wiggle room on that.”
The information Facebook sent me – an expanse of my life told through thousands of jpegs – is ultimately useless. That is almost by design, said the privacy activist Paul-Olivier Dehaye from personaldata.io.
“They hate this transparency,” he said of tech firms. “It is toxic for them so they will not do it if they are not pushed for it – and even then they will do it reluctantly.”
Instagram also did not send me any of my advertising data, which can be found in the app under its “access data” section. There, I can see what “ad interests” Facebook has gleaned from whom I follow and what I like on Instagram, information and interests on my Facebook account, and websites and apps I visit off the platform.
Some of the data released under California’s new privacy law. Photograph: Kari Paul
According to this Interests page, which was not included in my CCPA files, Facebook thinks I am interested in online shopping, yoga, pop music, cooking, sewing, reptiles, pomeranians, astronomy, astrology and Gucci. (Some of these assumed interests are more accurate than others).
Instagram said it does not sell user information “to anyone”, but declined to answer questions regarding the CCPA.
Under the CCPA, I also have the right to request my data be deleted. But Instagram was even less responsive to that than it was to my request to get the data in the first place, sending me through a labyrinth of customer service replies when I asked for it to be deleted. “This is the most bullshitty thing I have ever read”, said Ozbay of Cryptee about Instagram’s explanation of its refusal to delete the data.
Refusing to delete my data is also noncompliant with the CCPA, according to Mactaggart. He cautioned that many companies are taking their time to comply with the law, as enforcement does not begin until later this year. Consumers who feel companies are not complying with the law by refusing to send them data can report potential violations to the California attorney general, Mactaggart said.
California’s attorney general will begin enforcing the legislation in July 2020. Starting then, companies will face fines of $2,500 to $7,500 per violation if they are found to be intentionally violating the law.
“Companies willfully violating the spirit of the law should be careful,” Mactaggart said. “It’s going to take awhile for it all to settle out, but over time the fines are so extraordinary for violations there is going to be nowhere for them to hide on this stuff.”