Earlier this week, we were extremely concerned when Instagram proposed a set of changes to its terms of service and privacy policy that would have expanded the ways in which the service was permitted to use uploaded photos in advertising. In addition to concern about user photos being sold to the highest bidder, we were troubled to see the company modified language that previously protected the privacy of user photos. We’re happy to note that, after intense public pressure, Instagram has reverted to the prior policy with regard to advertising on the site and ownership rights of photos. Before seeking users’ agreement on new permissions, Instagram has promised that it will propose a specific program, so users can make a more informed choice.

However, while we appreciate Instagram’s responsiveness to user concerns and its improvements, the new privacy policy is short on clear privacy protections.

The newly revised terms have lost one of the clear statements from earlier versions of the privacy policy. Instragram used to say content marked private "will not be distributed outside the Instagram Services" – a strong, affirmative statement about how it would protect the privacy of content the user marked private. The Terms of Service Instagram is currently proposing merely say

You can choose who can view certain of your Content and activities, including your photos, as described in the Privacy Policy.

We examined the Privacy Policy itself, to see what promises the company made to safeguard your private photos. The proposed Privacy Policy says:

Any information or content that you voluntarily disclose for posting to the Service, such as User Content, becomes available to the public, as controlled by any applicable privacy settings that you set." [Emphasis added]

Thus neither directly promises that private photos will remain private. Instead, your privacy on Instagram is subject to future changes in the privacy settings options.

As you may recall, Facebook has, on a few occasions, adjusted privacy settings in ways that meant your ability to keep some information private was no longer available. These sorts of privacy downgrades have been met with quite a bit of criticism from users. Hopefully, Instagram will learn from that experience and refrain from removing privacy settings.

On its blog, Instagram has attempted to waylay criticisms of the reduced privacy policy, noting that “If you set your photos to private, Instagram only shares your photos with the people you’ve approved to follow you” and then clarifying that “The distribution of your content and photos is governed by our privacy policy, and always has been.” This falls far short of actually having language in the privacy policy that says “If you mark content as private, Instagram will not make it publicly available or distribute it to people you have not approved to follow you” — the type of strong, legally-binding language Instagram used to have.

It’s clear that users want to be part of the conversation about what happens with their content and information, and the strong public reaction against Instagram's changes showed that users are not happy to give licenses without knowing how they will be implemented. Instagram did the right thing by responding to user concerns about the advertising and ownership rights questions. We are particularly pleased to hear the company is going to wait until it solidifies plans for advertising before they suggest changes to their policies in the future, thus ensuring users will know what they’re agreeing to rather than giving blanket consent before an advertising program is developed. But we’re disappointed that Instagram has removed the clear, protective language from about protecting photos marked "private." Replacing clearly-worded privacy protections leaves the door open for the company to change its privacy settings and reduce user control of content, without any modification to the privacy policy.

The new terms are scheduled to take effect on January 19, 2012 — which means Instagram still has time to get this right.