Snapchat, run by Snap Inc., markets ephemeral messaging: its privacy policy says most messages are deleted from its servers by default after being opened by all recipients or expiring, unless a user changes settings or saves content. The record behind that promise is long. In May 2014 the FTC settled charges that Snapchat's 'disappear forever' claims were false: video snaps were stored unencrypted on the recipient's device outside the app's sandbox and could be retrieved through a file directory, screenshot detection could be evaded, the iOS app collected users' address books without notice or consent, the Android app transmitted location data despite a policy saying it did not, and an unsecured Find Friends feature let attackers compile 4.6 million usernames and phone numbers; the order requires 20 years of independently monitored privacy compliance. In October 2014 roughly 200,000 saved snaps leaked online after a third-party app, SnapSaved, that secretly stored users' snaps was hacked; Snap said its own servers were never breached, and SnapSaved took responsibility. In May 2019 Motherboard reported that Snap employees had abused an internal tool called SnapLion, built to answer law-enforcement requests, to look up users' location, saved snaps, phone numbers, and email addresses. In 2022 Snap agreed to pay $35 million to settle an Illinois Biometric Information Privacy Act class action alleging its Lenses and Filters scanned and stored users' facial geometry without consent, while denying that Lenses collect biometric data that can identify a person. A 2023-2024 UK ICO investigation examined its 'My AI' chatbot, and in January 2025 the FTC referred a complaint about Snap to the Department of Justice after an order-compliance review. Today the policy discloses, when device permissions are granted, collection of the phonebook, camera, photos, microphone, and precise location, plus everything typed to My AI as model 'Inputs'; Snap Map shows a user's live location to chosen friends until they hide it with Ghost Mode, and its App Store label discloses contact info and identifiers used for cross-app tracking.
TRACK RECORD
1 BREACH · 3 ENFORCEMENT ACTIONS
BREACH LEDGER
[2014-01-01] · BREACH
Have I Been Pwned lists a breach record for Snapchat: "Snapchat".
Approximately 4,609,615 accounts affected, per HIBP.
The FTC referred a complaint against Snap to the Department of Justice arising from an order-compliance review connected to the 2014 settlement, tied to concerns about the "My AI" chatbot's risks to young users, after investigators found reason to believe Snap was violating or about to violate the law.
In 2014, the FTC settled charges alleging Snapchat deceived consumers about the disappearing nature of messages and about the amount of personal data it collected, and that a security flaw in its "Find Friends" feature caused a breach exposing 4.6 million usernames and phone numbers; the resulting order required a 20-year independently monitored privacy program.
The FTC's 2014 administrative complaint against Snapchat, Inc. alleges that despite marketing snaps as disappearing forever, the app stored received video snaps outside its private sandbox so that, until October 2013, a recipient could plug the phone into a computer and save the file with simple file-browsing tools (a method publicized as early as December 2012); that recipients could easily evade the promised screenshot notification (on iOS before iOS 7 by double-pressing the Home button); that when users chose Find Friends the iOS app collected the names and phone numbers of every contact in their address book without notice or consent until September 2012; and that from October 2012 to February 2013 the Android app transmitted Wi-Fi and cell-based location to an analytics provider while Snapchat's privacy policy said it did not track or access location. Snapchat settled these allegations without admitting them.
Snapchat's privacy policy is described as sourcing user data from three primary channels — app usage, third-party partners, and information collected with user consent.
Snap's Privacy Policy (the version published as effective September 21, 2026) states that, when device-level permissions are granted, device information Snap collects may include the phonebook (contacts and related information), images and other information from the device's camera, photos, and microphone, and precise location; it also states that content users share and generate with Snap's AI features, including what they share with My AI (text, images, video, audio, precise location, and engagement), is collected as 'Inputs' used to generate 'Outputs', and that conversations with My AI are taken into account to improve its responses.
The FTC's May 8, 2014 press release states that Snapchat collected iOS users' contacts information from their address books without notice or consent (when users entered a phone number to find friends, the app also collected the names and phone numbers of all contacts on the device) and transmitted geolocation information from Android users despite a privacy policy saying it did not track or access such information; the resulting order bars misrepresentations about privacy and security and requires a comprehensive privacy program monitored by an independent privacy professional for 20 years.
Snap's April 25, 2023 explainer on My AI and location states that the My AI chatbot does not collect any new location information from users and only has access to a user's location if they have already granted location permission to Snapchat (the same permission that enables Snap Map sharing), and that Snap updated My AI to clarify when it is and is not aware of a user's location.
Reported institutional/strategic shareholders of Snap Inc. include Tencent Holdings, alongside asset managers such as Vanguard, indicating a traceable but multi-layered ownership structure.
Snapchat is owned and operated by Snap Inc., a publicly traded company on the NYSE (ticker SNAP) that uses a dual/multi-class share structure giving co-founders Evan Spiegel and Bobby Murphy voting control disproportionate to their overall equity ownership.
Snap's own Snap Map page describes the Map as letting users see where they and their friends are and have been; a user appears on friends' Snap Map once they are mutual friends, have opened the Map, granted device location permission, and chosen to share location with friends; they remain visible for 24 hours after last opening the app (indefinitely if they chose to share live location), and can hide from everyone except live-location recipients by entering Ghost Mode.
Snap Inc. entered a partnership allowing advertisers to access third-party offline purchase data (via Oracle Data Cloud) to improve ad targeting on Snapchat.
Snap's privacy policy discloses that information may be shared with affiliated companies within the "Snap Inc. family," with service providers, and that advertisers, app developers, and publishers may also share information with Snap.
Have I Been Pwned's breach catalog lists the "Snapchat" incident (snapchat.com), breach date 2014-01-01, affecting approximately 4,609,615 accounts. Data classes exposed per HIBP: Geographic locations, Phone numbers, Usernames. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
In 2014, the FTC settled charges alleging Snapchat deceived consumers about the disappearing nature of messages and about the amount of personal data it collected, and that a security flaw in its "Find Friends" feature caused a breach exposing 4.6 million usernames and phone numbers; the resulting order required a 20-year independently monitored privacy program.
The FTC's 2014 administrative complaint against Snapchat, Inc. alleges that despite marketing snaps as disappearing forever, the app stored received video snaps outside its private sandbox so that, until October 2013, a recipient could plug the phone into a computer and save the file with simple file-browsing tools (a method publicized as early as December 2012); that recipients could easily evade the promised screenshot notification (on iOS before iOS 7 by double-pressing the Home button); that when users chose Find Friends the iOS app collected the names and phone numbers of every contact in their address book without notice or consent until September 2012; and that from October 2012 to February 2013 the Android app transmitted Wi-Fi and cell-based location to an analytics provider while Snapchat's privacy policy said it did not track or access location. Snapchat settled these allegations without admitting them.
TechCrunch reported on October 13, 2014 that some 200,000 Snapchat photos had leaked after a third-party app used to save people's snaps was hacked (the 'Snappening'); Snapchat responded that the photos were stolen from a third-party application and that its own servers were never compromised, and Snapsaved.com then took full responsibility, saying hackers accessed roughly 500MB of images but, as far as it could tell, no usernames.
The Daily Beast reported on October 13, 2014 that a third-party Snapchat client, SnapSaved, was reportedly breached, leaking tens of thousands of private photos and videos online, and quoted Snapchat's spokesperson: the company's servers were never breached and were not the source of the leaks, and users were victimized by third-party apps that Snapchat's Terms of Use expressly prohibit; the leak mattered because the service's central promise was that snaps disappear from the device and are scrubbed from Snapchat's servers.
Engadget's May 23, 2019 report on the Motherboard investigation states that employees across several Snapchat departments could view user location information, saved Snaps, phone numbers, and email addresses through the SnapLion tool, that Motherboard's sources verified the tool's existence (four former employees and one current employee), and that two former employees placed the abuse 'several years' earlier without knowing whether it was continuing.
Motherboard (Vice) reported on May 23, 2019, citing two former employees who described the abuse, two further former employees, a current employee, and internal emails, that multiple Snap employees had abused privileged access to spy on Snapchat users several years earlier, using internal tools including one called SnapLion that could reach users' location information, saved Snaps, phone numbers, and email addresses; SnapLion was originally built to answer valid law-enforcement requests such as court orders or subpoenas, and internal emails showed Customer Ops and Spam and Abuse teams also had access.
The Cook County Record reported on August 22, 2022 that a DuPage County judge granted preliminary approval to a $35 million settlement by Snap Inc. of a class action under Illinois' biometric privacy law, with about $12 million of the fund expected to go to plaintiffs' attorneys; the suit claimed Snap improperly scanned and stored images of Snapchat users' facial geometry through the app's Lenses filter without consent or notice.
NBC Chicago's roundup of Illinois Biometric Information Privacy Act settlements (updated August 24, 2022) reports that Snapchat's parent agreed to a $35 million class-action settlement, that any Illinois resident who used Snapchat Lenses or Filters since November 17, 2015 was eligible to claim, and that the suit accused the company of collecting users' biometric information without consent, pending a final approval hearing.
Engadget reported on August 24, 2022 that Snap Inc. reached a $35 million settlement of an Illinois class action alleging Snapchat violated the Illinois Biometric Information Privacy Act by collecting and storing the biometric data of users who used its Lenses and Filters without their consent; Snap did not admit wrongdoing and stated that Lenses do not collect biometric data that can be used to identify a specific person or engage in facial identification.
The FTC referred a complaint against Snap to the Department of Justice arising from an order-compliance review connected to the 2014 settlement, tied to concerns about the "My AI" chatbot's risks to young users, after investigators found reason to believe Snap was violating or about to violate the law.
Snapchat's Apple App Store privacy label discloses that Contact Info and Identifiers collected by the app may be used to track users across apps and websites owned by other companies.