Meta Creates Privacy Risks by Tying New Threads App to Instagram

Over 100 million social media users have embraced Threads as an alternative to the site formerly known as Twitter, even as the privacy record of its parent company, Meta Platforms Inc., and its ties to Instagram are giving some people pause.

Meta notably received preliminary approval in March for a $725 million settlement resolving a consumer class action over the Facebook-Cambridge Analytica scandal. Facebook users sued in 2018 after revelations that the British political consulting firm had been allowed to access the account data of millions of the social network’s users during the 2016 US presidential campaign. Final settlement approval awaits a September hearing in California federal court.

It’s that kind of legal history that has some privacy lawyers advocating for caution.

“If you had to pick a worse steward for people’s information than Twitter, it would be Mark Zuckerberg,” said Eli Wade-Scott, a partner at Edelson PC, referring to the Meta CEO.

The new text-based, mobile-only microblog platform Threads has many similarities to Twitter, now known as X, including its repost, reply, and thread functions. But Meta’s ownership of Threads and its integration into Instagram—users can’t delete their Threads account without also deleting their Instagram account—raise distinct privacy concerns, practitioners say.

“By getting a Threads account, by using Threads, it’s not just a question of ‘What data is being collected, and how is it being used?’” said David Straite, a New York partner at Dicello Levitt. “It’s also ‘What data is it being combined with?’”

Social media platforms engage in two types of data collection, Straite said. The first is voluntary, when users provide their personal information when they sign up for an account to post digital content. The other method—which users may not be conscious—involves companies collecting information through browsers and apps, which it then matches to its users.

Straite gave the example of a user who forgot to log out of their Threads, Facebook, or Instagram account, then subsequently visited a news website. Meta could collect information like which articles they read and at what time of day, he said.

“Thousands of data points get collected simply by the fact of you having a Threads account and you interacting with a million other websites,” Straite said.

Just what types of data are being collected—or the extent to which users know about it—is hazy.

Consumer Confusion

Nazanin Andalibi heard about Threads through a notification on her personal Instagram account that someone had posted on the new app. She clicked on it and then was able to download the app.

Andalibi said she was relatively in the dark about what she was getting into—and she researches social media and privacy as a professor at the University of Michigan’s School of Information.

“In this process, there really wasn’t much about what data is going to be collected, kind of how it’s going to be used, or what it’s going to be used for,” Andalibi said.

According to Meta’s posted privacy policy, the company collects myriad kinds of information, including users’ device characteristics, IP addresses, contacts, and location data.

The company also discloses that it receives information from marketing vendors and third parties, like apps and games, about inside- and outside-app purchases, demographics, and ad interactions.

This information is shared with other Meta companies, according to the privacy policy, to “personalize” content and “promote safety, security and integrity.” Additionally, Meta provides data about ad location and engagement to third-party advertisers.

Though these policies are made available to users on the company’s website, Andalibi said, many still find them inaccessible or don’t read them.

Her perception is backed up by research on digital literacy. Polling shows that only a small minority of Americans surveyed say they always, or even often, read companies’ privacy policies before agreeing to them, said Monica Anderson, the director of internet and technology research at the Pew Research Center.

“Even when we ask questions about people’s level of understanding, you again see that there are relatively small shares, so only around 10% who say they understand a lot about these privacy policies,” Anderson said.

It isn’t legal jargon that’s preventing people from understanding Meta’s policy, said Wade-Scott—it’s their vague and convoluted wording.

“You don’t need to go to law school necessarily to understand any of those individual words,” he said. “But anyone who reads that comes away knowing basically nothing.”

A Meta spokesperson declined to offer comment for this article but noted previous online statements regarding Threads made by company officials.

EU Holdups

Though Threads was rolled out in the US on July 5, it’s not yet available in the European Union.

Rob Sherman, vice president and deputy chief privacy officer at Meta, recently said in a Threads post that the company would have liked to launch the app in the EU at the same time as other markets, and it does currently meet the requirements of the bloc’s General Data Protection Regulation.

The Digital Markets Act—EU’s new competition rules on how large online platforms use their marketing platforms—is part of the holdup, a person familiar with the matter told Bloomberg News earlier this month.

The rules establish criteria to limit “gatekeepers"—companies that amass at least $8.2 billion annually through their core digital platforms—from tracking users’ online browsing outside of their platforms to help inform targeted advertising efforts without “effective consent.” The designation of gatekeepers is currently underway, and companies will have to comply by March of next year.

“Building this offering against the backdrop of other regulatory requirements that have not yet been clarified would potentially take a lot longer,” Sherman said in his Threads post. “In the face of this uncertainty, we prioritized offering this new product to as many people as possible.”

The EU is generally noted as having far stronger data protections than the US, which has no federal consumer privacy law.

Consolidation’s Dangers

Privacy researchers also pointed to another concern about Threads: platform consolidation.

People’s ability to separate their social media platforms from each other is important, according to Andalibi, the Michigan professor. For example, a user might have a personal Instagram account for family and friends, while maintaining a professional-only Twitter profile, she said.

“They might not think of it as such necessarily always, but it is a privacy practice for people to compartmentalize their different networks,” she said.

Some users also choose not to provide their full names on platforms, she said, and linking accounts thwarts this practice.

Instagram head Adam Mosseri said in a recent post that Threads accounts can be deactivated without deleting a user’s Instagram account. Deactivation will hide the user’s Threads profile and content, his post said, and individual Threads posts can be deleted.

“Threads is powered by Instagram, so right now it’s just one account,” Mosseri wrote. “But we’re looking into a way to delete your Threads account separately.”

In the meantime, the interconnectedness of Threads and Instagram could raise antitrust questions, Straite said.

Looking forward, he emphasized the “real financial value” of users’ personal data to Big Tech companies, especially as they pursue more advanced artificial intelligence models. Data collected by platforms puts power in the hands of the largest aggregator, he said.

“Why would the company spend billions of dollars a year to create free products? Because they want you to use them. Why?” Straite said. “Most importantly, it’s the gathering of information. It allows them windows into everything you do online.”