[jazzychad]

Surprise! Likewise, Instagram uploads your contact list to their servers (phone numbers, names, emails) to help find friends (confirmed with mitmproxy as well). At least you have to click "Find from my contact list" first.

This practice is super-common. The last ordeal around this was a year or so ago with Kik, but then everyone stopped caring. At least Instagram is over https.

[LaGrange]

Uh, if they do it after clicking "Find from my contact list", this is totally different, that's opt-in. I do think it should be possible to opt-out from being findable this way, but that's a separate, if related issue.

[reidmain]

There is also a difference between "uploads" and "sends".

If they send my address book to their servers, compare it with current users and then discard it that is pretty good for an opt-in process.

A lot of this seems to be they upload the address book to their servers and store it permanently. The fact that they don't state this and don't ask for permission is disturbing.

[markchang]

Right. Kik did it without having an opt-out. At least Instagram does it after you tell it to. Path and Hipster? They just do it. Hipster, to a lesser degree.

[mcav]

Same with HeyZap.