Instagram's negligence, oversights, and a string of configuration errors allowed one of the social network's advertising partners to track millions of users' physical locations, secretly save their stories and accumulate users' personal information, reports Business Insider.
The San Francisco-based marketing firm Hyp3r's gleaning of data continued for the past year.
On Wednesday, Instagram sent Hyp3r a cease-and-desist letter after being presented with the publication’s findings, confirming that the startup had violated its rules.
"HYP3R's actions were not sanctioned and violate our policies. As a result, we've removed them from our platform. We've also made a product change that should help prevent other companies from scraping public location pages in this way," a spokesperson said in a statement.
Hyp3r denied breaking Instagram's rules, essentially arguing that accessing public data on Instagram in this way is legitimate and justifiable, and saying it was confident that any issues with Instagram would be resolved shortly.
The company’s CEO Carlos Garcia said in an emailed statement:
"HYP3R is, and has always been, a company that enables authentic, delightful marketing that is compliant with consumer privacy regulations and social network Terms of Services. We do not view any content or information that cannot be accessed publicly by everyone online."
Hyp3r is a marketing company that tracks social-media posts tagged with real-world locations, allowing its customers to interact directly with those posts via its tools.
It uses the data to target social-media users with relevant advertisements.
The news comes in the wake of a succession of outages that hit Instagram recently, with users reporting new posts were not appearing in their feed, and others saying stories and even the ability to log in had broken.
Problems were experienced across the world, according to independent outage monitor Down Detector.
User's fleeting Instagram activity is highly vulnerable as a variety of outside actors might repurpose the data without their knowledge.
Data scraping is a persistent problem across the web for open platforms. Instagram is not the only service to have been affected over the years.
The current report serves as an indication that Facebook's difficulties in ensuring users' personal information privacy extend beyond the core Facebook app, in an throwback to the Cambridge Analytica scandal of over a year ago, when it was revealed that Facebook users' data was exploited for fueling divisive political ad campaigns.
Instagram, owned by Facebook but operated as a mostly separate business, not been subjected to the same scrutiny as its parent company over the privacy backlash issues.