Young Instagram users give up privacy in search of metrics

Millions of young people are turning their personal Instagram accounts into “business” profiles to learn more about how their posts are performing. The trend has an unintended privacy consequence.

In order to be classified as a business on Facebook Inc.’s Instagram, users agree to provide their phone number or email to the public on the app. Their choice—made much easier by Instagram’s design and prompting—can endanger their privacy and that of their friends, according to David Stier, an independent data scientist who reported the issue to the company, and conducted a broad analysis on 200,000 accounts around the world with several different sampling techniques.

“I’ll talk to parents and say, ‘Did you know that if your 13-year-old turns their Instagram account into a business account, more than 1 billion people have access to their contact information?’” Stier said. “Every parent I talk to is like, ‘Are you kidding?’”

Many social media sites, including Instagram, set the minimum age at 13, a rule that many teens and even younger kids regularly flout to sign up.

In Instagram’s settings, there’s an option called “Get More Tools.” If users click the link, they’ll be asked if they’re a “creator” or a “business.” After they say what kind of user they are, they’ll be asked what contact information they want to display. Then they’re rewarded with a host of charts about how they’re performing on Instagram, including what days and times people view their posts, which ones were the most popular and how often and by what gender their profile is seen.

“Anyone can convert their Instagram account to a business profile,” Instagram said in a statement. “We allow this because we want anyone on Instagram to be able to start a business, if they wish to. During the setup process, we remind people that their contact information will be accessible to others, and allow them to update or hide that information.”

Stier verified people’s ages through information displayed in users’ bios or profiles. He said he has seen teens say they’re a “nonprofit,” or an “athlete.” But upon reviewing their profiles, he found that a significant portion of them were not businesses, but regular people, sometimes with mere hundreds of followers.

After he reported the issue to Facebook, Instagram made the contact information less obviously visible. But the company said they didn’t consider his findings a security vulnerability because users made their own choices about what information to display, according to an email exchange reviewed by Bloomberg.