FaceApp

Is FaceApp safe?

For most adults, FaceApp is reasonably safe to use today, and safer than its 2019 headlines suggest. Its privacy policy says the photos you edit are encrypted with a key that stays on your phone, cached on Google Cloud or Amazon Web Services, and deleted 24 to 48 hours after your last edit. It does not need an account, does not sell personal data, and Apple's privacy label lists no tracking at all.

The catches are elsewhere. The Android data safety form says FaceApp shares approximate location, app activity and device IDs with other companies, partly for advertising and marketing, which the Apple label does not show. The company publishes no security audit or bug bounty. And Brazil, the one country where the app has been tested in court, has ruled twice against how it was offered. We score it 62/100, ahead of Picsart (55) and Meitu (50).

Why FaceApp worried people in 2019

FaceApp went viral twice, in 2017 and again in July 2019 with its ageing filter. The second wave brought scrutiny. The app was then made by Wireless Lab OOO in St Petersburg, and its terms, last changed in 2017, gave the company a perpetual, irrevocable, transferable licence to users' photos and "any name, username or likeness". Senator Chuck Schumer asked the FBI and the Federal Trade Commission to investigate, and the Democratic National Committee warned presidential campaigns not to use the app, CNN reported.

In late 2019 the FBI replied that FaceApp and other apps developed in Russia could pose a counterintelligence threat, pointing to the data such apps collect and Russian law. That was a warning about where the developer sat, not evidence that FaceApp handed over data, and the company said Russian authorities had no access to user data.

What has changed since

Quite a lot, on paper. The current terms, dated November 2024, say FaceApp does not own your photos and takes a licence only to provide the service while the agreement lasts. The company responsible for your data is now FaceApp Technology Limited in Limassol, Cyprus, with a data protection officer and a UK representative for GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary requests. Photos stay on the device's encryption key, and FaceApp says it cannot hand them to anyone, including authorities, because it does not hold the keys. It also says it strips location tags and other metadata from uploads.

None of this has been checked by an outside auditor that we could find, so it rests on FaceApp's word. The policy also says support staff may access app usage data from other countries, without naming them.

What the app collects

Apple's label is short: purchases, a user ID, usage data and diagnostics, none linked to your identity and none used to track you. The policy adds device data such as IP address, push tokens and the city or country it implies, and says third-party SDKs may collect data directly from the app for analytics and, where the law requires it, marketing with your consent.

Google Play's form is the more complete picture. It lists approximate location, app interactions, device IDs and diagnostics as shared with other companies, for analytics, advertising or marketing and fraud prevention. Under our rule, when one disclosure is broader than another, we score the broader one, which is why privacy sits at 56 rather than in the 70s that the Apple label alone would suggest.

The Brazil rulings

Brazil is the only country where we found regulators or courts acting on FaceApp. In August 2019 the São Paulo consumer agency Procon-SP fined Google R$9.96 million and Apple R$7.74 million for offering FaceApp without terms of use or a privacy policy in Portuguese, and cited abusive clauses. FaceApp itself was not fined because it had no legal presence in Brazil. A São Paulo court rejected Apple's attempt to cancel its fine in 2021.

In December 2024 a São Luís judge, ruling on a suit by the consumer group IBEDEC, ordered Apple and Google to pay R$19 million in collective damages, to pay R$500 to each Brazilian user who can show they used the app up to June 2020, and to stop offering FaceApp until it complies with Brazilian law on clear information and data protection. That ruling can be appealed, and in October 2026 FaceApp was still listed on the Brazilian App Store. Both decisions name FaceApp, but the fines fell on the app stores, not on its maker.

Faces of other people

FaceApp has no feed, comments or messaging, so strangers cannot reach you through it. The risk runs the other way: its age, gender and face-swap filters produce realistic images of whoever is in the photo. The terms ban content that violates others' rights, and the privacy policy asks users not to upload photos of children under 13 unless they are the parent. Still, a convincing fake of a classmate or colleague takes seconds.

How to use FaceApp more safely

1. On Android, turn off the advertising ID, and on iPhone deny any tracking request.
2. Give FaceApp access to selected photos only, not your whole library.
3. After a session, tap "Request cloud data removal" in the app's support settings to clear cached photos before the 48-hour window ends.
4. Edit only your own face, or faces of people who have agreed.
5. Buy and cancel subscriptions through the App Store or Google Play; FaceApp sells nothing directly and leaves refunds to the stores.

How we scored it

Scams and harmful content (72) and regulatory record (72) are FaceApp's strongest factors. The app has no social features, and the Brazilian fines named it but fell on Google and Apple, so we count them at half weight; the 2024 court order came in a consumer group's lawsuit and counts only as context. Transparency and control (68) benefits from no account and a readable policy. Privacy (56) is the weakest, held back by ad sharing that only the Android form discloses, and security (58) by unaudited claims and no bug bounty. For an editor with stricter AI terms, see Remini.