Skip to content
Naked Security Naked Security

Know what Instagram knows – here’s how you download your data

Thank you GDPR.

Instagram, the visual story-centric social media platform owned by Facebook, has now added a long-requested feature: the ability for users to download their data – including images, posts and comments.
Not to be cynical, but Instagram is not making this move out of the kindness of its heart: the compliance deadline for GDPR is in a month and data portability is one of its many requirements.
What’s data portability? From the GDPR articles:

Data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format

To decode this a bit, the “data subject” means the user of the service – in this case anyone who uses Instagram.
While GDPR is meant to apply to any service that holds or uses the personal data of any European citizen, many online services are making GDPR-mandated services available to all their users regardless of where they live. This seems like a pretty good thing for everyone and a victory for user rights and privacy around the world.
So if you happen to be an Instagram user who’d like to quit the platform and delete your account, but would like to save the photos, videos and stories you’ve posted, the new Instagram “data download” option will allow you to take all your data with you when you leave.
To access this service, log in to your account, go to your profile, click “edit profile,” and then go to the “privacy and security” area. You’ll see a “Data download” header with a link to request a download of your data.
Once you make the request for your data, keep in mind that you won’t receive it right away. When I made my request, it took a few hours to get an email that my data was ready to download. Instagram says that it could take up to two days in some cases.

My data was split up into multiple parts. I’ve been a frequent Instagram user since 2012 or so, so I do have a lot of data I suppose.

The GDPR regulations say, in somewhat vague terms, mostly what needs to happen with user data and a little less on how it should happen.
The data portability requirement, for example, says users should be able to get their data in a “commonly used and machine-readable format.” If you try to download your data from Facebook, it’s presented to you in an HTML format, a machine-readable format that can be opened in a web browser so you can see it and click around to see the data they have on you.
Note that the GDPR regulation says “machine-readable” and not “human-readable,” though. Given that Instagram is part of Facebook, I had high hopes for what I’d see when downloading my Instagram data – that it would be readable and navigable, as my Facebook data was. Unfortunately, this was not the case.
While my images and videos were easy to view in JPG and MP4 formats respectively, all my other data was in JSON (JavaScript Object Notation) format, and while I know how to read it in a text editor, it’s not the friendliest option for the average Instagram user.

The good news is that JSON is a very well understood and commonly used format for storing and exchanging data, particularly on apps and websites. With Instagram data now available in this format a host of programs to read it, or import it into other apps and services, probably isn’t far away.
Opening up a JSON file, it’s clear that it’d take a little bit of formatting and parsing work to make this data dump really readable.

While it’s not terribly “human-readable”, this data checks the GDPR box of being “machine-readable,” and realistically, it’s probably not as interesting to most users as their pictures and videos. And let’s not lose sight of the big picture here – the good news is that your data is no longer walled up in the Instagram platform, and if you decide you want to leave, you can finally take your data with you.


Using the Android app, when I *Edit Profile* there’s no “privacy and security” area I can see. Nor can I find a “Data download”.
Is this possibly limited to we browsers and/or those who selected an EU country?


Actually looks like you need to use a web browser (a nice little road block, especially when the app likes to open up when you click on the webpage).


I’ve had my Instagram hacked, held for ransom, and deleted. Now all of that data is lost (or according to the Instagram “support” team). I’ve reached out to Instagram for DAYS with no response other than they can’t help me. Do you think according to this law I should be able to recover my account (and therefore, data) especially if it’s only been a few days?


Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!