Young Instagram users give up privacy in search of more metrics

Millions of young people are turning their personal Instagram accounts into "business" profiles to achieve higher followings. The trend has an unintended privacy consequence.

In order to be classified as a business on Facebook's Instagram, users agree to provide their phone number or e-mail to the public on the app. Their choice — made much easier by Instagram's design and prompting — can endanger their privacy and that of their friends, according to David Stier, an independent data scientist who reported the issue to the company, and conducted a broad analysis on 200,000 accounts around the world with several different sampling techniques.

"I'll talk to parents and say, 'Did you know that if your 13-year-old turns their Instagram account into a business account, more than 1 billion people have access to their contact information?' " Stier said. "Every parent I talk to is like, 'Are you kidding?' "

Many social media sites, including Instagram, set the minimum age at 13, a rule that many teens and even younger kids regularly flout to sign up.

In Instagram's settings, there's an option called "Get More Tools." If users click the link, they will be asked if they're a "creator" or a "business." After they say what kind of user they are, they will be asked what contact information they want to display. Then they are rewarded with a host of charts about how they are performing on Instagram, including what days and times people view their posts, which ones were the most popular and how often and by what gender their profile is seen.

Stier verified people's ages through information displayed in users' bios or profiles. He said he has seen teenagers say they're a "nonprofit," or an "athlete." But upon reviewing their profiles, he found that a significant portion of them were not businesses, but regular people.

After he reported the issue to Facebook, Instagram made the contact information less obviously visible. But the company said they didn't consider his findings a security vulnerability because users made their own choices about what information to display, according to an e-mail exchange reviewed by Bloomberg.

Stier argued that despite that choice, Instagram could protect users' privacy. It's possible to e-mail and call people without displaying their actual personal details. Many businesses use contact forms, for example, or anonymized e-mails. Instagram could do the same for minors, he said.

When people sign up to get Instagram's tools for businesses, the company doesn't verify that they are who they say they are. Instagram has blurred the lines between personal and professional, because so many regular people use their profiles for economic purposes, to create a brand for their art or photography or lifestyle.

But the metrics also matter to nonprofessional users. For the most part, users seek Instagram followings for the social currency they provide, creating something of a digital popularity contest. Instagram executives acknowledge the problem, and have proposed partly solving it by removing "like" counts on posts. The change is in testing in seven countries.

"We don't want Instagram to be such a competition," Chief Executive Adam Mosseri said in June during an interview on "CBS This Morning."