Security and privacy experts raise questions about viral selfie app Meitu's app permissions like GPS, call and carrier info, more that are unrelated to core use
You've probably seen a Meitu selfie in your Instagram or Facebook feed in the past 24 hours.
Context & Ripple Effects
Meitu arrived in this story as a scale player first: coverage last summer described a Chinese developer of selfie apps with hundreds of millions of monthly users and a multibillion-dollar valuation, followed by plans for a $710M Hong Kong IPO at up to a $5.2B valuation. The virality now spreading through Facebook and Instagram feeds put all of that momentum in front of Western users at once.
First-order effects
- Security and privacy experts are publicly questioning why a photo app needs GPS location, call logs, and carrier identifiers — permissions unrelated to taking selfies — putting Meitu's data practices under scrutiny at the exact moment it is courting international users and investors.
- Users encountering the app through viral social feeds must now weigh a fun, free download against an unusually broad permission footprint, which can translate directly into install drop-off and uninstalls.
Second-order effects
- The permission controversy raises the reputational cost of Meitu's expansion plays beyond the selfie app itself — including the later partnership with Xiaomi to sell phones under the Meitu brand — because a brand associated with over-collection taints whatever it licenses its camera software to.
- App-store gatekeepers and reviewers face pressure to treat broad-permission consumer apps as a category problem rather than case-by-case, since the same viral-distribution mechanics that made Meitu explode can amplify a data-practices backlash just as fast.
Third-order effects
- If the pattern holds, viral consumer apps from markets with looser privacy norms will keep hitting a wall in Western markets where the [[c:/concepts#public-data-permission-boundary|permission boundary]] between 'needed for the feature' and 'collected for the business' is policed by press, platforms, and eventually regulators — making data minimization a market-entry requirement, not a nice-to-have.
The trend: Viral consumer apps are discovering that their data-collection footprint travels with them across borders, turning permission requests into a gating issue for global growth.