Instagram has booted trusted advertising partner Hyp3r from their platform for secretly collecting vast amounts of user locations, personal photographs, and other information.
It turns out that Hyp3r, a marketing firm based in San Francisco, had been tracking user data and building detailed profiles over the past year.
What Hyp3r Has Been Doing On Instagram
According to Business Insider, the California company have been gathering data from Instagram stories, which are fleeting photographs and videos that are designed to disappear from user profiles after 24 hours. These personal content contain an incredible wealth of information, including locations, which can be used by third parties in ways that users are unaware of.
A source revealed that Hyp3r takes in more than a million Instagram posts every month.
Business Insider noted that the company used Instagram data without authority in three different ways. First, Hyp3r took advantage of a blind spot in Instagram security, which let them focus on a specific location and "vacuum" all the public posts made from that place. Second, they saved users' public Instagram stories in their permanent records, which is a violation of the platform's rules.
Finally, the company harvest data from Instagram profiles regularly, combining user biographies, followers, location information, and other data. All of these allowed Hyp3r to put together a comprehensive database on Instagram users, their interests, and their movements.
Hyp3r created tools to help them collect all the data, including one that "geofences" locations to suck up all the public posts made from these places. Another one saves Instagram stories in the company records.
Instagram Bans Hyp3r From Site
After Business Insider informed Instagram of their findings regarding the Hyp3r operations, the Facebook-owned social media website sent their partner a cease-and-desist letter for breaking their rules.
"HYP3R's actions were not sanctioned and violate our policies," a spokesperson from Instagram said in a statement. "As a result, we've removed them from our platform. We've also made a product change that should help prevent other companies from scraping public location pages in this way."
Hyp3r maintains that their practices aren't against Instagram's policies, saying that they are simply accessing public data in a legitimate manner. Content from private user profiles are not accessed or collected.
"Hyp3r is, and has always been, a company that enables authentic, delightful marketing that is compliant with consumer privacy regulations and social network Terms of Services," Hyp3r CEO Carlos Garcia says in a statement. "We do not view any content or information that cannot be accessed publicly by everyone online."
According to CNET, a recent Instagram fix denies access to user information if the user isn't logged into their account. The restriction will apply across all companies.
