"Instagram poses very high privacy risk through aggressive data collection of sensitive information, extensive cross-platform tracking for advertising, broad third-party sharing including across Meta subsidiaries, and indefinite data retention with vague justifications."
Take Action
2 Privacy Improvements Available
instagram Privacy Concerns & Scorecard
Instagram collects an exceptionally broad range of data including sensitive categories (religious views, sexual orientation, political views, health information, racial/ethnic origin, philosophical beliefs, trade union membership), biometric data (selfies), location data, device fingerprinting, and detailed behavioral tracking. Data is collected from non-account users and third-party sources about users' off-platform activity.
Data is extensively shared across Meta Companies without granular user consent, with advertising networks through Meta Audience Network, with numerous undefined vendors and partners, and with law enforcement in response to legal requests. The policy does not clearly restrict law enforcement sharing or require warrants.
Instagram enables extensive cross-site behavioral tracking and retargeting both on and off Meta Products using device identifiers, cookies, and off-platform activity data. Automated processing identifies interests and matches ads to users. Third-party off-platform information is used to personalize ads regardless of login status.
Data retention policy is vague with indefinite retention justified by undefined 'specific reasons'. The policy states data is kept 'as long as needed' with decisions made 'case-by-case' and data may be 'preserved for extended periods for specific reasons' without clarity on what constitutes legitimate justification.
While Instagram offers privacy controls and ad preference management, the policy uses vague language throughout, lacks explicit breach notification commitment, does not guarantee that account deletion removes all data, and lacks clear opt-out for core data collection practices. Policy changes can occur without explicit notice requirements stated.
Ai training opt out
- 1Go to the Meta Privacy Center at facebook.com/privacy/genai/ or navigate to Settings and privacy, then Privacy Center on Instagram or Facebook.
- 2Find the section about generative AI and look for the option to exercise your right to object to your data being used for AI training.
- 3Click or tap the link to submit a data subject rights request related to AI training.
- 4Complete and submit the form to request that Meta stop using your personal data for generative AI model development.
Sensitive content control
- 1Open the Instagram app and tap your profile picture in the bottom right to go to your profile.
- 2Tap the menu icon (three lines) in the top right.
- 3Tap Settings and privacy, then tap Content preferences.
- 4Tap Sensitive content.
- 5Select your preferred setting: 'Less' to see less sensitive content, 'Standard' for the default, or 'More' (if eligible) to see more.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Account creation, identification, and profile management
Content personalization, ad targeting, and user experience improvement
Location-based features, localized content, and location-based advertising
App functionality, device compatibility, and cross-device tracking for ads
App functionality, bot detection, user experience improvement, and product analytics
Service delivery, security, fraud detection, and bot detection
User authentication, preferences storage, analytics, and cross-site behavioral tracking
Content personalization, algorithm training, user engagement metrics, and ad targeting
Platform functionality, content moderation, AI training, and personalization
Account security, identity verification, and support
Payment processing, transaction management, and fraud prevention
Social networking features, content personalization, and ad targeting
Ad targeting, user profiling, cross-platform tracking, and personalization
AI model training, feature improvement, and personalization
Ad targeting, content personalization, and user segmentation
Cross-Platform Tracking
Instagram tracks your activity across other websites, apps, and devices using device identifiers, cookies, and pixels. Information about your off-platform activity is collected from third-party sources and used to personalize ads shown to you on Instagram and across Meta's advertising network. This tracking occurs even if you are not logged into Instagram.
Tracking Methods:
First-Party Cookies
Cookies set by Instagram.com to maintain login sessions, store preferences, and track behavior within Instagram properties
Third-Party Cookies
Cookies set by advertising partners and analytics providers to track users across websites and apps for cross-site behavioral tracking and retargeting
Tracking Pixels
Invisible pixels embedded on third-party websites and apps that send user activity data back to Instagram and Meta Audience Network for ad targeting
Device Identifiers
iOS IDFA and Android Advertising ID used to track users across apps and devices for cross-device user profiling and ad delivery
Web Beacons
Similar to pixels; used in emails and web pages to track opens, clicks, and user engagement
Fingerprinting
Combination of device identifiers, browser settings, IP address, and behavioral patterns to identify users even without cookies
Login-Based Matching
Tracking users across third-party websites and apps when they log in or use Instagram credentials, enabling cross-platform user identification
Local Storage & Similar Technologies
Browser storage mechanisms (localStorage, sessionStorage, IndexedDB) that persist across sessions and enable tracking even if cookies are disabled
Privacy Policy Updates & Analysis
Video content delivery infrastructure updated
Updated August 2026
The URLs for embedded policy explanation videos have been updated to use a different content delivery network (phx1-1 instead of lga3-2), which is a technical infrastructure change. This does not materially affect user privacy but reflects backend server location changes.
Key Changes:
- Video URLs changed from video-lga3-2.xx.fbcdn.net to video-phx1-1.xx.fbcdn.net
- Affects both 'What information do we collect' and 'How do we use your information' video embeds
- Purely technical CDN change with no privacy impact
New United States Regional Privacy Notice section added to navigation
Updated July 2026
A new navigation link titled 'Privacy notice for United States residents' has been added to the policy table of contents, pointing to section 12. Additionally, a direct reference to the United States Regional Privacy Notice has been added at the beginning of the policy with a link to detailed information about Personal Information handling and rights exercise for US residents.
Key Changes:
- New section 12 'Privacy notice for United States residents' added to TOC
- Prominent link to separate US Regional Privacy Notice added in policy introduction
- Link directs to dedicated USO privacy policy for US-specific rights and procedures
Removal of US Regional Privacy Notice link from main policy
Updated July 2026
The NEW version removes the direct link to the 'United States Regional Privacy Notice' that was prominently displayed in the PREVIOUS version. This notice previously provided US residents with specific details about handling Personal Information and exercising rights. The removal of this prominent reference may make it less obvious for US users to find their region-specific privacy protections.
Key Changes:
- PREVIOUS version included: 'Read the [United States Regional Privacy Notice](https://www.facebook.com/privacy/policies/uso/) for more details about how we handle Personal Information and how to exercise your rights.'
- NEW version completely removes this section
- US residents must now navigate separately to find region-specific privacy rights
AI & Data Training
instagram uses your content to train AI
Below is what's used and how (if at all) you can object.
What Content Is Used
Posts
Posts and content created by users are used for AI model training and product improvement
Comments
User comments on posts are collected and used for AI training purposes
Audio Content
Audio recordings, voice messages, and audio content are used for AI development
Direct Messages
Message content and message metadata are processed by AI systems, subject to applicable law and manual review
AI Feature Interactions
User queries to and interactions with AI features are tracked and used to train and improve AI systems
How to Object
- 1
Policy references Privacy Center and settings options but does not provide explicit AI training opt-out instructions in analyzed segments. Contact Meta Privacy Support for AI training opt-out requests.
Why We Analyzed instagram
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.