What we found
FaceApp: DFive hundred million people uploaded their face to a Russian company.
FaceApp is developed by Wireless Lab in St. Petersburg, Russia. When users apply filters, photos are uploaded to FaceApp's cloud servers for processing -- not processed on-device. Russia's SORM (System of Operative-Investigative Measures) laws require telecommunications companies to provide the FSB (Russia's security service) with access to their systems. While FaceApp states it doesn't share data with the Russian government, Russian law may compel it. FaceApp's terms of service grant the company a "perpetual, irrevocable, nonexclusive, royalty-free, worldwide" license to use, reproduce, modify, and publish photos uploaded by users. Senate Minority Leader Chuck Schumer requested FBI and FTC investigations in July 2019. The DNC warned 2020 presidential campaigns against using the app. Over 500 million people uploaded their faces to servers in Russia and granted a perpetual license to a company subject to Russian intelligence laws. The viral aging filter was a biometric data collection operation disguised as entertainment.
Google Photos: DYou uploaded baby photos.
Google Photos uses facial recognition to automatically identify and group faces across your entire library — including children. This creates one of the largest facial recognition training datasets in history. Google has used Photos data to train its AI models, including Gemini's image understanding capabilities. Users who upload family photos are contributing to a biometric database they never explicitly agreed to build.
CapCut: DA teacher tells a 10-year-old to make a video for a school project.
CapCut collects face data, location, device identifiers, keystroke patterns, and clipboard data from all users -- including the millions of children who use it for school projects and TikTok videos. No age verification prevents children from using face-based AR filters that submit biometric data to ByteDance's servers. COPPA (Children's Online Privacy Protection Act) prohibits collecting personal information from children under 13 without parental consent. Face data is personal information. CapCut does not gate face filter access behind age verification or parental consent. A child using CapCut's face effects for a school project is submitting their biometric data to a Chinese company. Schools that encourage students to create video content often recommend CapCut as a free tool -- inadvertently directing children's face data to ByteDance.