The latest social media trend to go viral is the face-altering software FaceApp, which uses a filter to make users look older.

An inspection of FaceApp’s terms of service reveals that users grant FaceApp a “perpetual, irrevocable, nonexclusive, royalty-free, worldwide, fully-paid, transferable” licence to use their image, name, and other content stored in the App for commercial purposes (i.e. for advertising) in any medium. Therefore, FaceApp could place a user’s image on a billboard without having to compensate them. FaceApp is also permitted to retain the content for as long as they wish, even after the App has been deleted.

Biometric data such as facial images is personal information, which is protected by data privacy laws. The terms of use allow excessive processing of its users’ biometric data, which is alarming.

FaceApp issued a statement advising that it might store an uploaded photo in the cloud, but that most images are deleted from their servers within forty-eight hours from the upload date, and that they do not sell or share any user data with any third parties.

Should they fail to do so, users could look to the European Union’s General Data Protection Regulation (‘GDPR’) or South Africa’s Protection of Personal Information Act No. 4 of 2013 (‘POPI’), depending on their location, for assistance. Under the GDPR there is a right to erasure (‘the right to be forgotten’), which can be used to ensure when an individual no longer wants their data processed and there is no legitimate reason to keep it, the data will be deleted. POPI provides a similar right.