Instagram Lands In Trouble For Storing Deleted Photos, DMs On Server For More Than A Year

Data is one of the most sensitive things today, especially if it's your photos or direct messages. Instagram has got itself in trouble for retaining photos and messages that were deleted by users on its servers. What's more, the photo-sharing platform had retained data, which were deleted for more than a year.

What Happened?

The report comes from TechCrunch, which details the discovery by security researcher Saugat Pokharel. Expecting the photos and videos to be deleted, Pokharel requested a copy of photos and direct messages from Instagram. Duly, the photo-sharing app sent him the data he had deleted more than a year ago.

Clearly, Instagram had never deleted the information from its servers, retaining it for more than a year. The Facebook-owned company says this happened due to a bug in its systems, which is now apparently fixed. The report notes that Pokharel discovered the bug back in October 2019, and was finally fixed now.

"The researcher reported an issue where someone's deleted Instagram images and messages would be included in a copy of their information if they used our Download Your Information tool on Instagram," an Instagram reporter told TechCrunch. Instagram also rewarded a $6,000 bug bounty to Pokharel.

How Dangerous Is It?

When we delete a photo, video, or any data for that matter, we expect it to go away completely. However, the Instagram instance has proved this wrong. To note, whenever we delete data from online services and platforms, there is a usual lag for some unspecified time before the data is fully removed.

In this case, Instagram notes that it usually takes 90 days to completely remove the deleted data. There are still a couple of unclear details. For one, we don't know how widespread the issue is, or how much data is still retained on Instagram servers.

Moreover, if Pokharel hadn't requested to download the data, we wouldn't have got to know about it either. This isn't the first instance we're hearing of retention of deleted data. Twitter too, had retained direct messages between users. For all we know, this might not be the last instance either.