New Chinese 'deepfake' face app backpedals after privacy backlash

Hong Kong(CNN Business) A new Chinese app that lets people swap faces with celebrities is updating its policies after a backlash from users concerned about their privacy and how its convincing fake image technology could be used.

The app, called Zao, works by superimposing an image of the user's face onto a character in a video or GIF using artificial intelligence (AI). It was uploaded to China's iOS App Store on Friday and became the most downloaded free app on the store by Sunday, according to tracking firm App Annie.

To use the app, you can sign up using your phone number and then upload images of your face from your phone.

Then you can choose from a number of videos — featuring celebrities such as Leonardo DiCaprio and Marilyn Monroe — onto which you can superimpose your face before sharing the results with your friends.

But privacy concerns were raised when people noticed the user agreement said people who uploaded photos surrender intellectual property rights to their face and allow Zao to use their image for marketing, according to Reuters. The user agreement has since been updated, and CNN Business could not immediately verify the original language independently.

Zao also raised questions about how the images could be used. Creating convincing fake audio and video — known as "deepfakes" — isn't new, but it previously took a great deal of time, skill and money. An app like Zao brings that technology to smartphone users around the world.

On Tuesday, Zao said it had changed its user agreement to address "concerns about privacy and safety issues."

"This is a new product. We were indeed inconsiderate about people's core concerns," the company said in a statement posted on the Chinese social media website Weibo.

According to the latest version of its user agreement, Zao "will try its best, based on the privacy terms, to use the content you have authorized us to use within a reasonable, necessary and expressly stated extent."

"Your necessary authorization and agreement will not change your ownership of the intellectual property rights," according to the terms.

The company also promised in its statement not to store "facial biometric data" on its app. It also said it would delete information about users "according to the law" if they erase their accounts. Parent company Momo Inc. told CNN Business that would also apply to any users who signed the app's original terms and conditions.

"We protect personal data and value data safety," Zao added. "We've also adopted several safety measures including storage encryption."

Big technological implications

Zao proved so popular that the app's servers almost crashed due to the sheer number of users, according to a post the app makers published Saturday on Weibo.

One Twitter user, Allan Xia, uploaded a video of his face swapped with Leonardo DiCaprio's.

Xia called the app the "best application of 'Deepfake'-style AI facial replacement I've ever seen," and said the video was generated in under eight seconds from one photo.

Concerns about fraudulent use of the app even prompted a response from Alipay, a popular Chinese online payment system.

"Rest assured that no matter how sophisticated the current facial swapping technology is, it can not deceive our payment apps," Alipay said in a statement Sunday on its Weibo account. "Even if the extremely rare case that an account is stolen, insurance companies will cover lost funds in full."

Zao said in its Tuesday statement that the use of its system would not cause "payment risks," adding that the "security threshold for facial recognition payment is extremely high."

Other uses of AI

The issues raised by Zao are reminiscent of FaceApp, another viral app that uses AI to transform user photos.

In early 2017, the service received a wave of press publicity for using artificial intelligence to transform pictures of faces, making them look older or younger, male or female, or adding a smile to appear happier.

It then went viral again in July 2019 and was met with renewed privacy concerns. The fears were sparked by an unverified — and now deleted — claim from a developer on Twitter about the app "uploading all your photos," along with the simple fact that the company is based in St. Petersburg, Russia.

In one densely-worded section of the terms of service, FaceApp informed users that they grant "a perpetual, irrevocable, nonexclusive, royalty-free, worldwide, fully-paid, transferable sub-licensable license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, publicly perform and display your User Content and any name, username or likeness provided in connection with your User Content in all media formats and channels now known or later developed, without compensation to you."

In other words, the company could effectively do what it wanted with your selfie.