Now that the dust has settled on the backlash over Instagram's attempt to change its terms and conditions in December 2012, it is a good time to examine what it tried to do, the furore which it provoked and what is happening in the social media marketplace. The story raises interesting issues not just from a legal point of view but also commercially (can social media survive on advertising revenue alone?) and even morally (is it right that users' personal data is being used in this way when many are only vaguely aware of default privacy settings?).

Instagram started out in late 2010 as a photo-sharing site. It was bought by Facebook in mid 2012 for the eye-popping sum of $1 billion. The change in its user terms seems to have been intended to bring Instagram into line with Facebook's own terms. Facebook is already using location information to display targeted advertising to its users, for example.

The pre-existing terms
Instagram's pre-existing terms were, relatively speaking, short and sweet, but already included a wide licence to Instagram to use content posted on the site. The terms of this licence were as follows:

"1. Instagram does NOT claim ANY ownership rights in the text, files, images, photos, video, sounds, musical works, works of authorship, applications, or any other materials (collectively, "Content") that you post on or through the Instagram Services. … You hereby grant to Instagram a non-exclusive, fully paid and royalty-free, worldwide, limited license to use, modify, delete from, add to, publicly perform, publicly display, reproduce and translate such Content …. except [that] Content not shared publicly … will not be distributed outside the Instagram Services.

2. Some of the Instagram Services are supported by advertising revenue and may display advertisements and promotions, and you hereby agree that Instagram may place such advertising and promotions on the Instagram Services or on, about, or in conjunction with your Content. The manner, mode and extent of such advertising and promotions are subject to change without specific notice to you."

So Instagram was given a licence to exploit users' photos in just about any way imaginable, except for "content not shared publicly" which would not be distributed beyond Instagram. This meant that Instagram could already – before the December change – use non-private photos in its own advertising. The meaning of "Content" clearly covered photos but did not seem to cover data such as where the user was when the photo was uploaded.

The December 2012 changes
At the end of last year, Instagram announced in a blog post what amounted to a wholesale upgrade of its terms. The meaning of "Content" had now been beefed up to include data, information, user names and profiles, and the licence to use it was now expressly transferable and sub-licensable. The changes which caught the attention of the user community, and the media, related to the following provisions:

"Some or all of the Service may be supported by advertising revenue. To help us deliver interesting paid or sponsored content or promotions, you agree that a business or other entity may pay us to display your username, likeness, photos (along with any associated metadata), and/or actions you take, in connection with paid or sponsored content or promotions, without any compensation to you. ….

You acknowledge that we may not always identify paid services, sponsored content, or commercial communications as such."

Although the old terms had given Instagram carte blanche to use uploaded photos (and although photos were certainly at the forefront of the ensuing criticisms), the main thrust of the new terms seemed to be to enable Instagram to exploit data about users and their activities by selling it to advertisers who could better target their campaigns. What is more, the new right to sub-license would entitle Instagram to permit a third party advertiser to exploit users' photos (again, on a billboard for example) without charge. Whilst photos on the site would be unlikely to be of a high enough technical or creative quality for advertisers to want to use them in this way (so that the more "in your face" forms of exploitation were unlikely to happen in practice), one can imagine more subtle, on-line uses such as seeing a friend's photo within an ad sent directly to your social network account or shown alongside your email inbox. Users took particular exception to the words "without any compensation to you" even though one could say this was just an example of Instagram being absolutely honest about its intentions. Those words are not needed from an English law point of view.

In business terms, it is not surprising that Instagram wants to tap into this part of the advertising market: traditional on-line advertising such as banners and pop-ups (which are already sounding rather quaint), launched in an era of PC dominance, are ill-suited to the smaller screen sizes of smartphones. For this reason, we can expect other "free" sites to go down a similar route and for advertisers to continue to seek increased access to customer and user data. Instagram has the added pressure of being part of a publicly quoted company, too.

The backlash and aftermath
The change triggered a high profile user backlash, with celebrities from Kim Kardashian to Pink announcing that they might close their accounts and a reported exodus of more than 25% of its daily active users (although Instagram disputes this figure). Instagram acted swiftly and announced that it would be changing its terms a second time. The main changes were to the privacy policy and also to the "rights" section of the terms, part of which now reads as follows:

"Some of the Service is supported by advertising revenue and may display advertisements and promotions, and you hereby agree that Instagram may place [these] on the Service or on, about, or in conjunction with your Content. The manner, mode and extent of such advertising and promotions are subject to change without specific notice to you.

You acknowledge that we may not always identify paid services, sponsored content, or commercial communications as such."

So the explicit references in the terms to "displaying" data and materials other than photos (such as usernames and profiles) have gone, but the sub-licensable licence to use them remains. This licence is subject to the privacy policy, which no longer talks about Instagram sharing user data with others. Instagram's right to place ads "in conjunction with" user Content remains, so it is still able to create advertising – or to enable third party advertisers to do so – which recycles photos for the purpose of selling products.

Reminder of the legal position
To be free to make use of photos and user data, a site like Instagram of course needs to consider legal issues such as data protection / privacy (in Europe, in most cases it will usually need to obtain fully informed and freely given consent from the individual to use personal data relating to that person); copyright and moral rights (to be able to copy and adapt photos and use them without crediting the photographer); defamation (if the way in which photos are used risks giving the wrong impression of a person identified in them) and – this is a more debatable area in the UK at least – image rights.

In the UK, image rights are an amalgam of rights, particularly passing off, where the use of a person's name or image might give the impression that they have endorsed a product or been paid to appear in an ad. How they apply in relation to ordinary members of the public (your friends on Facebook, say) as opposed to celebrities is not yet well-established, although our self-regulatory advertising code "urges" advertisers to obtain permission before referring to or portraying a member of the public.

The code also requires ads to be obviously identifiable (which is how a Wayne Rooney sponsored Tweet for Nike got into trouble in June 2012), and just stating in terms of service that ads "may not always be identified" will not remove the risk of an adverse adjudication by the Advertising Standards Authority.

What are Instagram's competitors doing?
When the criticisms of Instagram were in full flow, the Daily Mail reported how to download pictures from it and "upload them to another photo-sharing service with less invasive terms, like Flickr".

Flickr uses the Yahoo! terms of service which grant the site a licence to use publicly available photo content "solely for the purpose for which such Content was submitted" and only until the user removes it. But for other public content (such as "data"), the licence is wider: it is sub-licensable and irrevocable (so it lasts after the account has been closed or the content taken down).

Hipstamatic takes a sub-licensable, perpetual licence over all User Submissions (including photos and data) but only to use these "in connection with our websites and products", so not, it seems, for advertising of third party products beyond the confines of the site.

Lessons learned
Instagram has perhaps learned the lesson of how to launch new terms (and in California, a class action law suit has apparently been filed against it, so the furore is not at an end) and new sites have learned to try and get their terms right from day on.

Whether or not users have learned to look more closely at privacy policies rather than clicking "I agree" as a matter of course is far more debatable: in a recent survey on behalf of Microsoft for Data Privacy Day 2013, only 32% said they said they paid attention to companies' privacy reputations, track records and policies when choosing which websites to visit or services to use. This is borne out by experience in relation to another aspect of targeted on-line advertising, cookies. They were the subject of a change in the law in the EU in May 2011 EU (when the Privacy and Electronic Communications (EC Directive) Regulations 2003 and E-Privacy Directive 2000/58/EC were amended) introducing a system of opt-in consent. In practice, however, many users surely click to consent to these without troubling to examine details of how the site they are visiting uses cookies.

Maybe it will take another PR backlash, this time over the use of data or a photo rather than just over a change in terms, for people to realise that they need to look before they click and that there is no such thing as a free website.