Instagram Security & Privacy Scorecard
Android
Activity, behavior, and device data are collected extensively and shared with third parties. Payment information is handled through an integrated payment SDK. Users have limited ability to opt out of data collection while using the app.
Best for
Social sharing with standard data collection trade-offs
Avoid if
You want tight control over your personal data
Findings
- 0 critical
- 0 high
- 0 medium
- 0 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- OAuth Bearer Token Exposure to React Native JavaScript
- Unencrypted Local Database Storage
- WebView Autofill JavaScript Bridge Exposes PII
Top privacy issues
- Location Tracking Disguised as Network State Logging
- Cross-App Phone ID Tracking Without Consent
- Analytics Initialization Before User Consent
Full analysis
What This Means for You
Activity, behavior, and device data are collected extensively and shared with third parties. Payment information is handled through an integrated payment SDK. Users have limited ability to opt out of data collection while using the app.
Recommendation: Use With Caution
Best For: Social sharing with standard data collection trade-offs
Avoid If: You want tight control over your personal data
Key Findings
Data Security - 4 findings (3 critical, 1 low)
Network Security - 3 findings (1 high, 2 low)
Code Safety - 0 findings
Privacy - 3 findings (2 critical, 1 high)
Privacy Concerns
What Data is Collected
Extensive behavioral data is gathered during app use, including content interactions, search activity, browsing patterns within the platform, and device identifiers. Usage habits are tracked across sessions to build a detailed profile used for advertising and content targeting.
Third-Party Data Sharing
Data flows to multiple third-party services embedded in the app. Firebase Cloud Messaging handles push notifications and associated device identifiers. The Trustly Payment SDK processes payment-related interactions. The Tigon HTTP Stack and GraphQL layer facilitate ongoing data transmission to advertising and platform infrastructure. React Native serves as the UI framework for portions of the app.
Understanding the Scores
| Category | Score |
|---|---|
| Security | 35/100 |
| Privacy | 30/100 |
| Data Security | 25/100 |
| Network Security | 70/100 |
| Code Safety | 60/100 |
| Data Collection | 35/100 |
| Data Sharing | 40/100 |
| User Control | 25/100 |
Positive Security Features
No notable positive security practices were identified in this version of the app.
Areas for Improvement
- Personal data stored within the app may not be fully protected, particularly for sensitive information.
- Data is shared broadly with advertising and analytics partners, and the app offers limited options to restrict that sharing while keeping the app functional.
- Controls for opting out of behavioral profiling and data collection are minimal, giving users little practical choice over how their information is used.
About This Analysis
This scorecard reflects findings from automated static analysis of the app binary and is intended to help users make an informed decision about installing or continuing to use this app. Server-side behaviors and practices not visible in the app itself are not captured here.
App Details
- Package: com.instagram.android
- Version: 414.0.0.40.83 (build 382006479)
- Scan Date: January 31, 2026
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 32/100 |