When you delete personal information from one of the many popular social networks out there, you expect the data to be removed from the company’s servers permanently in an appropriate timeframe. That’s not been the case on Instagram, though.
As TechCrunch reports, independent security researcher Saugat Pokharel used Instagram’s Download Your Information tool to see what data the social network had stored on its servers about him. He was surprised to find photographs and private messages he’d deleted more than a year earlier, and in a few cases there were photographs he’d deleted back in 2013. Instagram’s policy is to remove any deleted data from its servers within 90 days, so clearly something went wrong.
Pokharel reported his discovery to Instagram and in return earned himself a $6,000 bug bounty reward. An Instagram spokesperson has since commented, “The researcher reported an issue where someone’s deleted Instagram images and messages would be included in a copy of their information if they used our Download Your Information tool on Instagram. We’ve fixed the issue and have seen no evidence of abuse. We thank the researcher for reporting this issue to us.”
The year-long retention of deleted data should therefore no longer happen for Instagram accounts, but this does raise the question of other services and if their data deletion policies actually function as described. Last year, Twitter was caught storing direct messages years after users had deleted them, so this is clearly not just an Instagram problem.
