When you delete something from Instagram, you expect it to be gone forever. But when security researcher Saugat Pokharel asked for a copy of photos and direct messages from the photo-sharing app, he was sent data he deleted more than a year ago, showing that the information was never completely removed from the Instagram was removed.
Instagram says this was due to a bug in its system that has now been fixed, and Pokharel received a $ 6,000 bug bounty for highlighting the issue. As indicated by TechCrunch, Pokharel discovered the bug last October and says it was fixed earlier this month.
“The researcher reported an issue where someone’s deleted Instagram images and messages would be included in a copy of their information if they used our Download Your Information tool on Instagram,” an Instagram spokesperson told Instagram. TechCrunch. “We resolved the issue and saw no evidence of abuse. We thank the researcher for reporting this issue to us. “
It’s not clear how widespread this problem was and whether it affected all Instagram users or just some of them, but it’s certainly not an uncommon problem. Whenever we delete data from online services, there is usually an indefinite delay before the data is completely removed from the site’s servers. For Instagram, the company says it usually takes about 90 days to completely delete data. But security researchers have found similar problems in the past with other services, including Twitter, which saved direct messages between users years after they were supposedly deleted.
In this case, the problem only came to light because Pokharel had the option to download a copy of its data from Instagram. The company owned by Facebook introduced this download tool in 2018 to comply with EU data privacy regulations.
The GDPR requires EU citizens to have a “right to access” their data, which allows them to request a copy of any information a company stores about them within a reasonable time. As we’ve discovered in our experiments in exercising this right, the information you receive isn’t always self-explanatory, but in the case of Instagram, it is easy enough to search through it. It’s also the only easy way to find out if companies kept your data long after you asked them to delete it.