May 5, 2015 · 2 minutes

Microsoft thinks I'm a 39-year-old man. I know this because I, along with countless others, uploaded a photo to the company's "How Old Do I Look?" site. It's a neat gimmick, even if its estimates are usually off by a couple decades. It's also a pretty good way for the site's developers to collect all kinds of data.

Fast Company pointed out that many people were uploading pictures of their faces to a website that promised to tell them something they already knew. It also quoted this excerpt from the terms of service for Microsoft Azure, which powers the site, to warn people about thoughtlessly sharing their pictures:

However, by posting, uploading, inputting, providing, or submitting your Submission, you are granting Microsoft, its affiliated companies, and necessary sublicensees permission to use your Submission in connection with the operation of their Internet businesses (including, without limitation, all Microsoft services), including, without limitation, the license rights to: copy, distribute, transmit, publicly display, publicly perform, reproduce, edit, translate, and reformat your Submission; to publish your name in connection with your Submission; and to sublicense such rights to any supplier of the Website Services.
Microsoft later assured Fast Company that the site won't store any images uploaded to its service. Crisis averted... until others pointed out that this doesn't mean the site isn't collecting data -- it just means your face probably won't  make an unexpected appearance in a Microsoft commercial any time soon.

Here's what the website's creators say they were able to collect with the tool:

In addition to age and gender, we also used additional information provided by standard web browsers, such as the User Agent string that comes with every standard HTTP call and the latitude and longitude of location from where the picture was uploaded. These can be used to calculate standard website usage statistics such as the number of hits from iPhones, Windows or Android, or places where how-old.net is most popular.
The researchers provide an example JSON document showing that they were able to collect information about who someone is, where they live, what browser they are using, and what device they used to upload the photo. It is, in other words, grabbing all kinds of metadata while deleting the photos themselves.

I'm not sure how that's supposed to be comforting. Metadata can reveal a lot about a person, and it's been used to expose everything from a Congressman's excessive travel budget to political blackmail by New Jersey's Chris Christie. Users of the "How Old?" site shouldn't dismiss the collection of this data.

Yet despite these concerns, "How Old?" doesn't seem to be slowing down. It's still popping up in my Twitter feed, and it looks like the site will remain up for the foreseeable future. One of its creators, Joseph Sirosh, provided information about how popular the site has been in a tweet published earlier this morning:

Looks like all it takes to get tens of millions of people to volunteer their information is a buggy tool that seems to be wrong more often than it's right. Not that I have any room to talk -- after all, I did upload a picture of myself to the site, to see what all the fuss is about. So much for caring about privacy.

[illustration by Brad Jonas]