A new app knows what your Instagram-loving friends did last summer. Called Who’s in Town, the iOS and Android app is ostensibly designed to show you, well … who’s in town. But it does much more than that.
Users who download the app and grant it access to their Instagram account are presented with an eerie interactive map of every place the people they follow have visited and shared online since they created their profile. The map updates in real time and is sourced from the wealth of location data the average Instagram user willingly uploads to the platform each time they opt to use its popular geotag feature in a story or post.
This information is nominally public already, as Instagram users must choose to share it with their followers. But by collecting them all in one place over time, Who’s in Town transforms data points seemingly meaningless in isolation into a comprehensive chronology of the habits and haunts of anyone with a public Instagram account.
It can tell you what coffeeshops or restaurants your Instagram-using friends frequent, when they last told the digital world they were there, and paint a detailed picture that wouldn’t be evident from just looking at their profile.
“The amount of data is insane,” said Erick Barto, the app’s creator. “It’s the equivalent of you going through every single story and writing down every single location, just consistently all the time.”
Paris Martineau covers platforms, online influence, and social media manipulation for WIRED.
A pre-release study he conducted using Who’s in Town tracked the posting habits of over 15,000 active Instagram users over multiple weeks. Barto said it found that 30 percent of people who post Instagram stories over the weekend geotag at least one location.
“This capability is problematic … from a privacy perspective as long-term aggregate data can potentially be misused in various ways,” Jason Polakis, security researcher and assistant professor at the University of Illinois at Chicago, told WIRED in an email.
Polakis said users’ aggregate location data could reveal sensitive information about their daily routine—like when a person normally goes out, or is at work—that could be used to determine when their home is empty, enabling stalking, or revealilng social connections like friendships or relationships, based on similarities in the time and location of posts. The information could also be used by companies to infer a person’s hidden habits or traits, he noted. A health insurance firm, for example, could scan prospective customers’ geotag history to compare how often they indicated they frequented bars versus the gym.
“While the app’s functionality isn’t doing anything complicated that a determined (malicious) individual or company wouldn’t be able to do,” Polakis added, “it does streamline and facilitate potentially invasive behavior at a large scale, as anyone installing the app would have access to this functionality.”
Once installed, Who’s in Town pulls post data for the people you follow dating back to the creation of each user’s account, and the geotags from stories posted that day. Since Instagram stories (and any geotags contained within them) disappear after 24 hours, older stories won’t be displayed on the map; however, the longer you have the app installed, the more detailed the map gets, as it slurps up data from every subsequent geotagged Instagram story shared by your friends.