Instagram Bans Partner Hyp3r for Secretly Tracking Millions of User Locations
Instagram removes marketing partner Hyp3r after the company secretly collects location data and ephemeral stories from millions of users. The social network makes a product change to prevent similar scraping in the future.
A marketing partner called Hyp3r secretly collects and stores location data on millions of Instagram users in direct violation of platform policies. After Business Insider reveals this massive data scrape, Instagram confirms the violation and immediately removes Hyp3r from its platform. A Facebook spokesperson states that Hyp3R's actions are not sanctioned, and Instagram implements a product change to prevent other companies from scraping public location pages in this way.
Hyp3r originally starts as a legitimate advertising platform that uses Instagram's official API to target users at specific events like concerts or baseball games. However, after Instagram severely restricts API access to location and user data in early 2018, Hyp3R shifts to circumventing the platform's minimal security barriers. The company exploits Instagram's Location pages to hoover up public accounts visiting specific places, regardless of whether the scraper is logged in.
The scope of the data collection goes far beyond simple event targeting, as Hyp3R builds detailed shadow profiles by combining exact locations, objects in photos, and visited places with other demographics. The company even builds special tools to save users' personal stories, which are designed to disappear permanently after 24 hours. This secret tracking continues for years, raising serious questions about whether Instagram is ignorant of the scraping or simply looks the other way.