New Profile Pic App: Innocent Photo Fun, or a Privacy Risk?

Maybe you've seen some of your Facebook friends upgrading their profile pictures to look like fancy illustrations of themselves. They're likely using a free app called NewProfilePic Picture Editor, the latest social media craze. And while the new images may look glamorous, using the app may be a bad idea -- but perhaps not for the reason some say. Let's look at the facts.

What is NewProfile Pic?

NewProfilePic is an app you can get for iOS or Android. It does pretty much what it says -- makes your profile image look like a painting, using artificial intelligence. People on various social platforms are having fun tinkering not only with their own photos, but images of famous people and pets.

So what's the controversy?

On Wednesday, the UK tabloid The Daily Mail published a story with the unnerving headline, "Is Russia after YOUR personal data? Experts warn internet users not to download latest online craze New Profile Pic that hoovers up your details." ("Hoovers" as in "vacuums," for those not up on British slang.)

The Daily Mail quotes a security expert who says "this app is likely a way of capturing people's faces in high resolution and I would question any app wanting this amount of data, especially one which is largely unheard of."

Wait, what's the Russia connection?

Once the app became popular, people began digging into the company's history. It turns out the NewProfilePic domain was originally registered in Moscow. Given the war in Ukraine and the history of hackers working in Russia, just the mention of Russia's capital sets off suspicions for some would-be app users.

But the company isn't located in Moscow, though it does have an office in Russia.

"We are a [British Virgin Islands] company with development offices in Russia, Ukraine, and Belarus," a representative for PhotoLab, the company behind the app, told me. "All user photos are hosted and processed on the Amazon AWS and Microsoft Azure servers, which are located outside the Russian Federation. ... It is the truth that the domain was registered to the Moscow address. It is the former Moscow address of the founder of the company. He does not live in the Russian Federation now."

But these are complicated times.

"We understand that due to the current events in Ukraine, any connection to Russia could raise suspicions," the representative said. "That's why we want to share the position on this issue on our founder's Instagram."

In that Instagram post, company founder Victor Sazhin says he was born in Moscow, moved to Ukraine as a child, and is against the war launched by Russia against Ukraine.

Company founder speaks

Sazhin told me via email that he felt the Daily Mail story hyped up anti-Russia hysteria.

"I haven't been completely surprised [by the negative reaction]," he said. "Recently when our other app, Photo Lab, was No. 1 in Ukraine, when people were using it to create patriotic avatars with a beautiful effect we created, some Facebook [conspiracy theorists] started a similar story. And a few years ago when we first got viral in Bangladesh and India, there was another 'story'... but tying us to the CIA."

He praised the research done by Snopes.com, however. The urban-legends site wrote an article after the Daily Mail story was published in which it concluded NewProfilePic is not especially invasive, noting that, "the claim that this app is stealing data for the Kremlin is also unsupported by evidence."

"That [Snopes] review is comprehensive and I probably can't add anything to it," Sazhin told me. "The app is safe, the photos are processed on Amazon and Azure servers, and we are not KGB."

Shades of FaceApp in 2019

I spoke to cybersecurity journalist and author Bob Sullivan about the app.

"This feels exactly like the FaceApp situation, with one important difference: the world is at war with Russia now," he told me. 

Back in 2019, a similar app, FaceApp, was all the rage -- you could use it to age a photo of yourself or alter it in other creative ways. It was also based in Russia, and the FBI investigated the app.

War changes everything

"Many Russians are great developers," Sullivan told me. "Many Russians who learned to program there and now live abroad run very successful companies. The world needs Russian programmers."

Sullivan understands that Russia's invasion of Ukraine, and Russia's autocratic president, Vladimir Putin, leave many suspicious of apps related to Russia in any way.

"People have to understand that even if a person or company has every good intention of not sharing data with a government, they can be compelled to do so anyway," Sullivan said. 

The PhotoLab spokesperson told me, "We did not and do not plan to have any affiliation with any governmental organizations of any country."

You're giving away your photos

Russia aside, is it smart to hand over a photograph of yourself to an app you know little about?

"I really think people are crazy to use this app or anything like it," Sullivan said. 

Artificial intelligence researchers, he says, are "desperate" to acquire large datasets they can feed into a computer to perfect their algorithm.

"You have no way of knowing where these images of you might end up in the future," Sullivan said. "For that reason alone, don't do it."

The company representative pointed me to their privacy policy, which states, "The photos are sent to the servers through the encrypted connection. We use Secure Socket Layer technology to protect the privacy and integrity of the transmission process."

The policy goes on to say, "For non-registered users and users who don't share their results within the Services, the original photos and results are automatically removed from our servers by two weeks after the last interaction. For registered users who share their results within the Services that provide special social network features, the shared content will be stored on the servers and shown within the Services unless a user either removes the images themselves or requests such a removal by contacting our support team."

Permissions and pet photos

But what if you've already used the app? And are you safe if you don't use photos of your own face, but, say, of your cat or horse?

"The app probably has an ongoing way of feeding information about you back to its owner, so I would delete it immediately," Sullivan said. "Same for the cat theory. I don't know what they are doing with non-picture data. But every piece of info you share ends up in the horrible ad-tech ecosystem, with inferences drawn that would shock you."

The app's requested permissions are similar to those of other mainstream apps. 

"I do agree this app doesn't ask for more than many apps .... which doesn't make it right, but that's not suspicious on its own," Sullivan said.

It's the hot new app

The app is popular. On Friday, it was the top free app on the Apple app store.

"Without any doubt, we are happy that users enjoy our NewProfilePic and ToonMe apps so much," the representative told me. (ToonMe is a similar app from the company that turns photos into cartoons.) "And for sure we are going to do our best to create even more stunning effects and make even more users happy."

Company founder Sazhin echoed that.

"It seems we finally found the recipe with NewProfilePic," he told me. "It looks like a quick success (and it kind of is -- this viral wave started only last Saturday, one day after we released a new set of effects in NewProfilePic), but it was actually years of work."

Support your local artists

Even if a company has never had a Moscow address, users should think twice before agreeing to hand over personal photographs to an app you know nothing about, even for an elegant profile pic, Sullivan says.

"When you share intimate data like your face with an app like this, you have no way of knowing where that data will end up," Sullivan warned.  "If you really want a cool portrait of yourself, hire a local artist!"