Facebook-owned Instagram can sell your photos

Your photos could be sold and displayed for commercial purposes, if sweeping changes to photo-sharing site Instagram's terms and conditions go ahead.

The hugely popular photo app, which was acquired by Facebook earlier this year, has announced some major changes to its terms of use and privacy policy which come into effect on January 16.

The specific addition in the updated terms and conditions in regards to this is pretty straightforward. It reads:

"To help us deliver interesting paid or sponsored content or promotions, you agree that a business or other entity may pay us to display your username, likeness, photos (along with any associated metadata), and/or actions you take, in connection with paid or sponsored content or promotions, without any compensation to you."

Let's break that statement down a little.

Say you go on a trip and take photos of your hotel room, your meal or even yourself sunbathing by the poolside. Potentially, the hotel could pay Instagram/Facebook for the use of those photos, and display them on their own website or marketing material -- with no financial compensation to you.

Where the terms of service talks about metadata, this specifically means the information stored in the photograph that identify the time, the GPS co-ordinates (ie the exact location; unless location services are turned off), the phone used and more besides (like keywords used to tag the photo).

Your likeness, is of course, your photo. So who knows, a photo of yourself in your bikini drinking a particular beverage could be plastered on a billboard by the drink manufacturer. (This may well run foul of privacy laws, but there doesn't seem to be anything in the small print that suggests this kind of thing couldn't happen somewhere down the line.)

No doubt that as this story hits the news, disgruntled users will cry foul and Instagram/Facebook may well water down the terms and conditions -- they could at the very least, make this clause something you're able to opt-out of.

In another worrying development, Instagram also says:

"You acknowledge that we may not always identify paid services, sponsored content, or commercial communications as such."

This could be in breach of advertising codes of practice, which state that such content should clearly be identified as such.

Sources: For more on this, check out the Cnet article about the topic as well as the new Instagram terms of use and privacy policy.

What Facebook collects about you

Facebook's privacy policy is written in plain English, but there are still a few vague phrases kicking around. So, what stuff does Facebook hold on you?

Apart from the usual stuff all websites know about you when you visit (like the numerical identifier, called the IP address, that traces you back to your internet provider) Facebook says it holds personal information you "knowingly choose to disclose that is collected by us and Website use information collected by us as you interact with our Website". This essentially means everything you say and do on Facebook is collected, because everything you do on there is a knowing disclosure - right?

It also says "you provide us with certain personal information, such as your name, your email address, your telephone number, your address, your gender, schools attended and any other personal or preference information that you provide to us". Wow. I certainly haven't told it all of this stuff. I think I registered before you had to specify your gender, so it doesn't know this, either. If people make all of this stuff available for even close friends to view (and say a friend's account gets hacked), it's perfect fodder for an identity thief.

You also need to provide Facebook with your date of birth, because you need to say you're over 13 to use the service. I always provide my date of birth to identify myself when I call a bank.

Note: All this doesn't even apply to the third-party applications that you might have installed. As soon as you give them permission to install themselves on to your Facebook profile, they have access to your data, too. And in an earlier post we discussed Beacon, the feature that broadcast certain actions on third-party websites to your friends that you may have preferred to keep private.

Third parties that you haven't even given permission to access your profile can access aggregated information about you. It's not personally identifiable, but your actions are contributing to Facebook's bottom line. "We do this for purposes such as aggregating how many people in a network like a band or film and personalising advertisements and promotions so that we can provide you with Facebook. We believe this benefits you."

We believe this benefits Facebook, too, n'est-ce pas?

Oh, and most creepy of all, "We may use information about you that we collect from other sources, including but not limited to newspapers and Internet sources such as blogs, instant messaging services, Facebook Platform developers and other users of Facebook, to supplement your profile."

Huh? This is probably something Facebook will focus on more in the future, as information becomes more easily tied to individuals. Does this mean Facebook will be able to associate your profile with, say, a mention of you in a local newspaper? When you list your blog on your profile, will it scan the blog and tie it up with your likes/dislikes? And as Microsoft has a small stake in Facebook, and you list your Hotmail address to sign up - where will that end? Facebook says: "Where such information is used, we generally allow you to specify in your privacy settings that you do not want this to be done or to take other actions that limit the connection of this information to your Profile (e.g. removing photo tag links)."

What I don't like about Facebook is it doesn't make it easy to delete information about myself. If I need to delete things individually from my Wall, for instance - I can't do multiple deletes. Making it possible is one thing, but it's also quite difficult to do.