Instagram Deleted My Account Without Warning—and Then Refused to Give Me My Pictures

After months of trying and being refu­sed access to my own user data, I found myself at the preci­pice of nearly commit­ting fraud to get my user infor­ma­tion, photos, and videos back from Insta­gram.

Never had I been to Fort Irwin, Cali­for­nia, a mili­tary base in the Mojave desert where exer­ci­ses are conduc­ted against simu­la­ted enemies to prepare for war. But, three years after leaving the Army, I was sear­ching for addres­ses there that I might claim as my own.

My jour­ney to the base, at least digi­tally, had begun when my Insta­gram account was disa­bled a few months ago. Suddenly and without warning, I lost access to all of the images and other data I uplo­a­ded on the appli­ca­tion over years. Obtai­ning access to my own crea­ti­ons so I could have a backup was harder than I had imagi­ned though—so hard that a virtual move to the Moja­ve—so I could claim resi­dency in Cali­for­nia and obtain my infor­ma­tion via the state’s digi­tal rights laws—­se­e­med to be the only option left.

The ques­tion of the dubi­ous lega­lity of doing so made me go no further, but others—the people I got the idea from—­ha­ven’t had such qualms. In an era of unli­mi­ted connec­ti­vity, physi­cal loca­tion remains para­mount when it comes to data privacy and data access for users. It’s so impor­tant that some are driven to lying to obtain the protec­ti­ons offe­red by a small group of states and nati­ons.

If even a user’s access to their own data is deter­mi­ned by their geograp­hic loca­tion, what does that mean for more trou­bling ques­ti­ons about how this infor­ma­tion is being used?

When my account was first disa­bled, the Insta­gram appli­ca­tion infor­med me that I could appeal the deci­sion, which I did. Even­tu­ally, I lost the ability to do even that. So I used the multi­ple methods Insta­gram sugges­ted to appeal the disa­ble­ment deci­sion, since I beli­e­ved it to be a mistake. For months, I tried to jump through their hoops—­sen­ding in a photo of my driver’s license, verifying my iden­tity with a selfie taken with a sheet of paper that had a unique code writ­ten on it, and other efforts.  Even­tu­ally I figu­red that if I couldn’t get my account reac­ti­va­ted, I could at least down­load a copy of my data using the tool Insta­gram has crea­ted for those who can’t access their accounts.

I hadn’t posted inap­pro­pri­ate content or anyt­hing unusu­al–I simply recei­ved a message one day that I viola­ted the Terms of Service some­how. Based on Insta­gram’s TOS, they have the right to disa­ble accounts in such a manner, which as a private site is in their purview.

But an account being disa­bled is not the same thing as one being dele­ted. My account and its data still exist and is presu­mably being used for Meta’s busi­ness model—I just can’t log in or use it in any way, even to utilize Insta­gram’s built-in data down­load feature.

When I finally used the tool to request my user data from Insta­gram in hopes of being able to at least down­load the files I had uplo­a­ded, I got the first response from a human. The privacy depart­ment infor­med me that they could not give me my data unless I logged in. When I replied to them that my lack of account access preven­ted my data access, the repre­sen­ta­ti­ves respon­ded that they were “unable to assist me further based on the infor­ma­tion I provi­ded” and that they consi­de­red the matter over.

They then closed my help ticket. Months later, my data is still inac­ces­si­ble.

I began looking online to find out more infor­ma­tion about my situ­a­tion, seeing if others had expe­ri­en­ced the same response of being denied access to their own infor­ma­tion. I even­tu­ally ended up on the unof­fi­cial Insta­gram subred­dit where I found multi­ple posts from users there who have found them­sel­ves unable to log in and there­fore unable to retri­eve their data. Some have even attemp­ted to buy back access to their data and accounts, purcha­sing ads on Face­book’s busi­ness plat­form to get access to a speci­a­li­zed chat support feature that’s speci­fic for busi­nes­ses.

Nothing was guaran­teed to work except for virtu­ally moving to the Mojave. I read a Reddit post that sugges­ted that if Meta refu­sed to provide your Insta­gram data to you, the best option was to fill out a consu­mer compla­int in Cali­for­nia with the Office of the Attor­ney Gene­ral. Not living in the state didn’t matter, appa­rently: The poster from Reddit said they’d just used a random Cali­for­nia street address in their compla­int. And it had worked. Others in that Reddit thread made the same claim, an exam­ple of the effect of dispa­rate data privacy laws.

That’s of Cali­for­ni­a’s Consu­mer Protec­tion Act. Under Cali­for­nia law, consu­mers in the state have the right to know about the perso­nal infor­ma­tion busi­nes­ses collec­ted, used, shared, or sold about them, inclu­ding speci­fic pieces of perso­nal infor­ma­tion and data. The right to know means you can speci­fi­cally request your data from plat­forms. For now, Cali­for­nia is the only state with compre­hen­sive consu­mer data privacy laws that go beyond the limi­ted exis­ting fede­ral rules. (Utah, Colo­rado, Connec­ti­cut, and Virgi­nia have also passed such laws, too, but they don’t effect until vari­ous points in 2023.) So if I truly did live in Cali­for­nia, under the law, Meta would have to rele­ase that infor­ma­tion to me.

The same holds true in some other coun­tries as well. For instance, in 2018 the Euro­pean Union adop­ted strin­gent privacy protec­tion measu­res in its Gene­ral Data Protec­tion Regu­la­tion, desig­ned to harmo­nize data privacy laws across its member coun­tries and grant grea­ter protec­ti­ons to indi­vi­du­als. If your account is suspen­ded by Insta­gram and you live in the EU, you’re cove­red by arti­cle 15 of the GDPR and can request your infor­ma­tion.

If your state or country doesn’t have privacy laws, it’s unclear what rights you have. Face­book’s current TOS states that you “retain owners­hip of the inte­llec­tual property rights in any such content that you create and share on Face­book and other Meta Company Products you use.” The current terms also state “If you delete or we disa­ble or delete your account, these Terms shall termi­nate as an agre­e­ment between you and us, but the follo­wing provi­si­ons will remain in place: 3, 4.2–4.5.”

Section 4.2 is lite­rally the section this text is in, meaning it’s citing itself. Section 4.5 doesn’t exist. Beyond the text on a person owning inte­llec­tual property rights, Section 3 says nothing about privacy and data access consi­de­ra­ti­ons beyond the user’s privacy settings. Face­book’s privacy policy meanw­hile simply says users can request their data at any time. But, again, if Face­book disa­bles some­o­ne’s account on Insta­gram, that person can lose all access to the data the company has gathe­red on them with no guaran­teed recourse. (I reached out to Meta for a comment on their data access policy but did not receive a response.)

Since no nati­o­nal law which regu­la­tes data access and privacy, not having access to one’s data on a social media site for any reason is not fede­rally recog­ni­zed for any legal action as of now. The Fede­ral Trade Commis­sion currently focu­ses on issues of data brea­ches, expo­su­res of private user data due to a company’s secu­rity prac­ti­ces. One such was with the data breach Equi­fax announ­ced in 2017 which affec­ted 147 million people.

I asked Tori Ekstrand, an asso­ci­ate profes­sor in the Huss­mann School of Jour­na­lism and Media at UNC-Chapel Hill who speci­a­li­zes in media law, about my situ­a­tion, and she told me, “The United States has lagged behind coun­tries when it comes it comes with crea­ting a compre­hen­sive data privacy protec­tion frame­work.” She noted that seve­ral bills are currently pending before Congress, most notably the bipar­ti­san Ameri­can Data Privacy and Protec­tion Act. The bill would  esta­blish a “duty of loyalty, ” impo­sing a base­line obli­ga­tion on compa­nies to not collect, process, or trans­fer data unless compa­nies reaso­nably need it to provide products or servi­ces to exis­ting custo­mers. Compa­nies would not be able to deny service or adjust prices for an indi­vi­dual to who refu­ses to waive their privacy rights. Finally, it would esta­blish a right to data and infor­ma­tion access for consu­mers, manda­ting that compa­nies must provide access to consu­mers upon request inclu­ding what third parties a user’s data has been given to.

“With states like Cali­for­nia passing their own privacy laws, there is concern among lawma­kers and data scien­tists about a ‘pat­ch­work’ appro­ach to regu­la­ting digi­tal privacy, ” Ekstrand said.

The ADPPA is currently being held back from a vote in the House of Repre­sen­ta­ti­ves by Spea­ker of the House Nancy Pelosi, whose reaso­ning seems to illus­trate Ekstrand’s point: She feels that the bill doesn’t go far enough in its data protec­tion rules and would weaken the Cali­for­nia CPA.

“Privacy consi­de­ra­ti­ons weren’t part of the blue­print of modern social media sites, ” said Ekstrand. “Adding privacy support can be seen as equi­va­lent to the chan­ges to buil­dings after Ameri­cans With Disa­bi­li­ties Act was passed in 1990.”

The bene­fits of data privacy and control will bene­fit those at the most seri­ous risk first, such as when eleva­tors were manda­ted by the ADA to be added into all new buil­dings and retro­fit­ted into the older ones. Those bene­fits then moved “downs­tream” to others who weren’t the origi­nal popu­la­tion targe­ted to help; we’ve all used the ADA manda­ted eleva­tors in buil­dings.

Maybe one day I’ll be able to get my old photos and videos in the same manner.

Future Tense is a part­ners­hip of Slate, New America, and Arizona State Univer­sity that exami­nes emer­ging tech­no­lo­gies, public policy, and soci­ety.

Photo illus­tra­tion by Slate. Photos by Insta­gram and charles­de­lu­vio on Unsplash.