22

I'm building an app that works across mobile devices and browsers. There is a chat component and I will be showing the profile photos that I find on the user's phone book (not from the image folders). To make these images visible on the web if the user works on a browser, I upload the profile photos from the user's phone to a server, and deliver them to the web app.

To support OTHER users, if they do not have a profile photo on their phone, I intend to display the first one that was uploaded, which came from somebody else's phone.

The app asks for permission to use the users phone book. And there is fine print that the profile photos will be used in this manner.

Irrespective of the fine-print, is this 'acceptable use'? Am I opening my company to some risk?

Improve this question
11
  • 30
    I upvoted this question because I think it is an interesting question, but not to endorse this practice. I fully agree with Trish. It is a bad idea to publish images from the users device without explicit consent of the user, explicit consent of the person depicted and not even knowing what those images actually depict. And I don't think that any kind of fine print users probably never read makes it OK. Even if it were OK legally (which I doubt), it would certainly not be ethically OK.
    – Philipp
    Commented Jul 22, 2022 at 9:21
  • 4
    @Philipp That's precisely how we're supposed to use the upvote button. A good question is never limited to things that are personally, or generally, agreeable. We upvote for others to see the answer "DON'T DO THIS".
    – TCooper
    Commented Jul 22, 2022 at 20:10
  • 1
    If you want "default" profile icons, I suggest copying SE's approach instead.
    – Brian
    Commented Jul 22, 2022 at 20:16
  • 8
    @SunilGupta Even ignoring what is legal, you should also try to consider what is right. Informed consent is important; that's why more and more jurisdictions are enshrining it into law. It's not important because it's in law!
    – wizzwizz4
    Commented Jul 23, 2022 at 14:06
  • 1
    Even if you don't take payments from EU users, if you're mishandling PII of EU persons and your business has any presence in EU jurisdictions (or might decide to do so in the future), you may be in for a nasty surprise.
    – R.. GitHub STOP HELPING ICE
    Commented Jul 24, 2022 at 19:46

2 Answers 2

Reset to default
49

BAD idea

It is one thing to upload the phonebook and associated pictures for use of the owner of the phonebook.

It isn't a fair use of the phonebook pictures - and you might not have a license anyway, as some people associate photos with numbers that they don't have a license to associate with anyway.

But what if instead of a photo of the person, the first photo someone associated with the person is a photo of something like... crack cocaine, a photo of someone in a very compromising situation, just genitals, or some other thing that is just as tasteless or possibly criminal to share? In that case, your company is possibly committing defamation, and in case sharing or possessing of the image itself is illegal, your company is now the actor and liable. Depending on the content of the picture, distribution of pornographic material (possibly even underage material of that sort) could be up that alley just as much as hate speech through symbols, usage of banned symbols (such as swastikas in Gernamy) and many many others.

Improve this answer
1
  • 11
    And it's sooo easy to abuse if you know how the system works.
    – DonQuiKong
    Commented Jul 24, 2022 at 13:21
18

Super illegal

Just focusing on the GDPR, what is your legitimate basis for taking the personal information of a third-party?

Improve this answer
3
  • This is a teaching/student app. When a teacher/student adds a new contact (which can be via a telephone number, may not be in that user's phone book) - I wanted a way to show a profile picture. There are apps (like TrueCaller, which also have user consent) to show the phone users profile to others, when they call someone. Yes, these do not show profile photos from their phonebook... anyway, it's likely that my reasoning will not be a 'legitimate basis' under GDPR...
    – Sunil Gupta
    Commented Jul 22, 2022 at 13:15
  • 11
    @SunilGupta the point is that a GDPR legitimate interest (LI) requires a balancing test. Here, the data subjects are (a) the person whose contact book you're uploading, and (b) the person described by that contact. You would have to balance their interests/rights/freedoms against your interest in providing default contact pics. There's a slim chance that you might have a LI if both parties can reasonably expect this, in particular if everyone involved is a user of your platform. But I strongly suspect that your interest does not outweigh those people, especially considering personality rights.
    – amon
    Commented Jul 22, 2022 at 18:13
  • 6
    @SunilGupta and especially with what some people associate with people's numbers. Dick-pics are only the tip of the iceberg.
    – Trish
    Commented Jul 23, 2022 at 7:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .