It’s the hottest thing on the Chinese internet right now, apart from speculation over Kris Wu maybe having a girlfriend. But while the launch of deepfake-style face swap app ZAO has seen it leap to the top of download charts, it’s also raising a host of privacy concerns on Chinese social media, an intriguing development in a country where mass surveillance and facial recognition technology are prevalent.

The app — developed by Momo, the same company behind popular Chinese dating app Tantan — became an overnight sensation after it began circulating on Friday evening. Hashtags related to the app quickly became some of the hottest on microblogging site Weibo, while the app rocketed up the iOS download charts. Chinese social media feeds quickly became filled with ZAO-produced videos from friends and contacts for many users.

Update: Some social media platforms, including WeChat, have now started blocking ZAO videos (WeChat has done this before with popular rival short video apps).

The premise of the app is pretty simple: take a selfie and put yourself into your favorite movie or soap opera (chosen from a pre-selected list of clips). Cue users giving themselves starring roles in Leonardo DiCaprio’s filmography or uninvited guest appearances on Game of Thrones.

In case you haven't heard, #ZAO is a Chinese app which completely blew up since Friday. Best application of 'Deepfake'-style AI facial replacement I've ever seen. Here's an example of me as DiCaprio (generated in under 8 secs from that one photo in the thumbnail) ? pic.twitter.com/1RpnJJ3wgT — Allan Xia (@AllanXia) September 1, 2019

Yet the initial buzz around the app quickly gave way to headlines about privacy concerns as reporters from several major tech publications in China actually bothered to read the 6,000 character user agreement required to download ZAO. One clause in particular is causing consternation as it appears to give the app’s developers the global rights to use any imagery created on the app for free. Once a user has opted in, there doesn’t seem to be the right to revoke the agreement.

Update: ZAO has now responded to the above complaints by amending the user agreement. The new agreement states that content generated on the app will now no longer be used for other purposes without the user’s prior consent. It also says that if a user deletes content on ZAO, this will be wiped from ZAO’s databases too, and injects a clause stating that users bear responsibility for having the authorization to use portraits in the app (thereby making the user culpable if someone’s photo is used without their permission).

Related:

Given the prevalence of facial scan technology in China, the app’s life-like productions have also caused concern among those who fear it could be used to hack into their bank accounts. Alipay, the country’s biggest mobile payment service and one which has been a major proponent of facial scan technology for payments, has been forced to reassure users that ZAO’s deepfakes can not be used to bypass their security checks.

Yet some have taken to social media to express concern that ZAO’s face-swapping tech offers huge potential for criminals, either through the creation of malicious materials or by using it to dupe a user’s family and friends.

Related:

A poll about attitudes to ZAO on financial website Caijing’s Weibo account on Saturday attracted more than 40,000 votes, with just over 40% questioning whether the app was “collecting the private data of users”. Just over 25% responded with “Sounds fun, I want to try it”, while slightly fewer votes went to the statement, “What if someone else uses my face?”

Given the government’s propensity for removing apps it deems controversial from app stores, it remains to be seen whether ZAO will be able to navigate these privacy issues and maintain its runaway popularity.