How Old Do I Look Microsoft website raises privacy concerns

People who upload photos of their faces to the new How Old Do I Look website are giving Microsoft the right to use the pictures for nearly any purpose, despite the company's promise not to retain them, privacy experts say.

The age-guessing site was unveiled at the Microsoft Build conference last Thursday, and within four days it had already received 240 million pictures from 33 million different users, according to a tweet from Microsoft vice-president Joseph Sirosh.

Microsoft says on the site it will not keep the photos.

• Read more on Microsoft's blog post on How Old Do I Look

But the terms of use for the website, which is covered under Microsoft's general cloud-services agreement, say the company and its affiliates can copy, edit and distribute any uploaded pictures for use with their internet services, as pointed out by Brandon Wall, who works with the social media team at Buzzfeed News.

David Fraser, a Halifax-based privacy lawyer, said the terms of service appear to give Microsoft the right to use the photos for advertising or other purposes, but he said he doubts the company would purposefully deceive its users.

Classic problem with general agreements

The contradiction between Microsoft's general policy and the website's promise not to keep the photos is a classic example of the problem with companies using generic legal language to cover all of their websites rather than tailoring agreements to individual services, Fraser said.

But he added that it is common among large internet companies such as Microsoft, Facebook and Google.

"People should be mindful of what is in the terms of use of the service that they are using," Fraser said. "At the same time, corporations like Microsoft should be as clear as possible about what it is that they're purporting to do."

A Microsoft spokeswoman reiterated that the How Old Do I Look website, which uses a face-detection algorithm and machine learning to detect the age of those who upload photos, does not store pictures or personal information and was originally intended as a demonstration of the ease of developing on Microsoft's cloud services.

"We planned to take it down right after the keynote but it seems folks really enjoy playing with the service, so for now we are leaving it up," Leanne Bull of Veritas Communications said in an email.

Avner Levin, director of Ryerson University's Privacy and Cyber Crime Institute, said almost no one, including himself, reads the terms of use for most online services.

Designed to give companies as much control as possible

What were originally developed as meaningful agreements of users' rights have now become policies designed to give companies as much control as possible, he said.

Howard Deane, director of the Consumers' Council of Canada, said it was reassuring that Microsoft volunteered that it would not keep the photos.

Adding a new privacy policy for every new service adds complexity for companies and makes it more confusing for users, he said, and doesn't solve the underlying problem.

"People want their privacy policies in plain language and in smaller chunks," he said. "Businesses can start doing pretty good deals with people if they're just more open and transparent about how they're using their information."