China’s red-hot face-swapping app provokes privacy concern

Chinese face-swap app Zao rocketed to the top of app store charts over the weekend, but user delight at the prospect of becoming instant superstars quickly turned sour as privacy implications began to sink in.

Launched recently, Zao is currently topping the free download chart on China’s iOS store. Its popularity has also pushed another face-swap app, Yanji, to fifth place on the list. Behind Zao is a company fully owned by Chinese dating and live-streaming service Momo Inc. President Wang Li and co-founder Lei Xiaoliang, according to public company registration documents.

Users of the app upload a photo of themselves to drop their likeness into popular scenes from hundreds of movies or TV shows. It’s a chance to be the star and swap places in a matter of moments with the likes of Marilyn Monroe, Leonardo DiCaprio, or Jim Parsons as Sheldon Cooper on “The Big Bang Theory.”

The photo uploads have proven problematic, however. A user can provide an existing photo or, following on-screen prompts, create a series of photos where they blink their eyes and open their mouth to help create a more realistic deepfake. An earlier version of Zao’s user agreement stated that the app had “free, irrevocable, permanent, transferable, and relicense-able” rights to all this user-generated content. Zao has since updated its terms — the app now says it won’t use head shots or mini videos uploaded by users for purposes other than to improve the app or things preapproved by users. If users delete the content they upload, the app will erase it from its servers as well.

But the reaction has not been quick enough. Zao has been deluged by a wave of negative reviews. Its App Store rating now stands at 1.9 stars out of five following more than 4,000 reviews. Many users complained about the privacy issue.

“We understand the concern about privacy. We’ve received the feedback, and will fix the issues that we didn’t take into consideration, which will need a bit of time,” a statement posted to Zao’s account on social-media platform Weibo said.

On Monday, the China E-Commerce Research Center urged authorities to look into the matter. The app “violates certain laws and standards set by the nation and the industry,” the research house said in a statement, citing Wang Zheng of the Taihang Law Firm.

It’s not the first time such face-swapping apps have enjoyed popularity either in China or around the world, but Zao’s smooth and quick integration of faces into videos and internet memes is what makes it stand out.

The machine learning technology underpinning deepfakes of this kind has matured rapidly, to the point where it can believably impersonate famous personalities like Joe Rogan and make them say whatever the aspiring faker types. U.S. politicians are wrestling with the issue of how to regulate this emergent misinformation threat, and top Democrat Adam Schiff has described it as a source of “nightmarish scenarios” for the 2020 presidential election.

At the individual level, FaceApp is the most famous and notorious deepfake face-modification app to date. It went viral globally on two different occasions, showing people how they’d look in their old age or with their gender flipped. The app also kicked up an unintentional privacy scare with its practice of uploading images to servers to be processed, illustrating a growing sensitivity to how user data are handled.

After users flooded WeChat, China’s most widely used social media platform, with Zao-enabled short clips and GIFs, the Tencent Holdings Ltd.-operated messaging app banned links to the service, saying there have been numerous reports about it presenting “security risks.” Tencent didn’t immediately comment on the decision.

“I just realized the terms are so unfair but it’s too late,” one unhappy iOS reviewer of Zao wrote. “Nowadays people don’t usually bother to read them.”

“Rubbish, hooligan software,” added another reviewer.

Colum Murphy and Zheping Huang write for Bloomberg. Vlad Savov and Lulu Yilun Chen contributed to this report.