Instagram API exposed the country users chose to hide

Instagram lets you hide the country your account is based in, and promises that other people will then only see that you chose not to show it. I found that the mobile API kept returning that country to anyone who asked, in a field called home_country, even for private accounts. Meta fixed it as of 2024-04-04.

What does Instagram promise?

Instagram promises that a hidden country stays hidden from other people. Every profile has an About this account page that shows when the account joined and the country or region it is based in. In the Android app, under Primary country/region, a toggle called Show country/region controls that line. The text under the toggle reads:

“This is the country/region where your account is based. If you turn this off, people will not be able to see where your account is based but they will see that you chose not to show it.”

The Instagram Show country/region setting turned off, with the promise text under it. — Figure 1. The Show country/region setting and the promise under it.

The app kept that promise on screen. The API behind it did not.

How did the hidden country leak?

What happened

When the Android app opens a profile, it asks the server for that account’s details. The request is a plain authenticated call with the target account’s numeric ID:

GET /api/v1/users/<USER_ID>/info/ HTTP/2
Host: i.instagram.com
X-Ig-App-Locale: en_US
X-Ig-Device-Locale: en_US
...

The JSON response describes the profile: counters, flags such as has_videos, the profile picture URLs, and many more fields. Among them sat the account’s country as a two-letter code (trimmed here):

{
  "user": {
    ...
    "has_private_collections": true,
    "has_saved_items": true,
    "has_videos": false,
    "home_country": "<COUNTRY_CODE>",
    "hd_profile_pic_url_info": {
      "url": "https://instagram.<CDN_HOST>/..."
    },
    ...
  }
}

Burp Suite showing the user info request and a response that still contains home_country. — Figure 2. The user info response still carries home_country after the country was hidden.

The field was there whether Show country/region was on or off. It was also there when the target account was private. Any signed-in account that knew or looked up a user ID could read it.

Flow: the owner hides the country, another account calls the user info API, the server adds home_country without checking the setting, and the response exposes it. — Figure 3. The privacy toggle changed what the app displayed, not what the API returned.

Reproduction

You need two accounts you own: one that hides its country and one that looks it up. I used Instagram for Android version 323.0.0.35.65 and an intercepting proxy.

On the first account, open Settings, then About this account.
Turn off Show country/region.
Optionally, make the first account private.
From the second account, open the first account’s profile and capture the request to /api/v1/users/<USER_ID>/info/.
Search the response for home_country. It still holds the hidden country.

The home_country field in the user info response. — Figure 4. The home_country field in the response.

What was the impact?

Anyone with an Instagram account could learn the country of any other account, including accounts that had deliberately hidden it. That matters most for people who hide their location for safety: activists, journalists, people avoiding a stalker or an abusive ex-partner. Country alone is coarse, but combined with other public details it narrows down who and where someone is. The leak was also silent: the owner saw “chose not to show it” and had no reason to think otherwise.

What did an attacker need?

A normal signed-in Instagram account.
The target’s user ID.

Nothing else. Turning off Show country/region did not stop it, and neither did making the account private.

Why did it happen?

Instagram hid the country on screen but never removed it from the data. The server sent home_country to every caller, whether or not the owner had hidden it, and left it to the app not to display it. Anyone who looked at the raw response could read it.

How was it fixed?

Meta patched the issue as of 2024-04-04, and the same day I confirmed that the hidden country no longer leaked through this endpoint. In general, this kind of bug is closed by enforcing the privacy choice on the server: when a field is hidden, leave it out of the response for everyone except the owner, rather than sending it and relying on the client to hide it.

What can developers learn?

Enforce privacy settings where the data leaves the server. A toggle that only changes the UI protects nothing from anyone with a proxy.
Build responses per viewer. The owner, a follower and a stranger should get different objects when settings say so.
Audit large profile responses for fields the UI never shows. Every extra field is a promise you may be breaking.
When you add a privacy toggle, test it at the API layer, not only on screen.

FAQ

Is this fixed?

Yes. Meta patched it as of 2024-04-04, and I verified the fix the same day.

Was anyone’s data exposed?

I accessed only my own test accounts. While the bug was open, any signed-in account could have read the country of any other account through this API.

Did making an account private help?

No. The field was returned for private accounts too.

What should users do now?

Nothing. The fix is on Meta’s side. Your Show country/region setting now works as described.

What was the root cause?

The server always included home_country in the user info response and left it to the app to hide the country on screen.

Timeline

2024-03-27: Reported with step-by-step reproduction.
2024-03-29: Sent a fuller impact description.
2024-03-31: Triaged and routed to the product team.
2024-04-04: Meta reported the issue patched.
2024-04-04: I verified the fix.
2024-04-04: Meta awarded a bounty.
2026-10-23: Write-up published.