Selfies, 4chan, and a war of the sexes: Lessons from the hacking of Tea

“I met him at a running club a few months ago, don’t know his dating history but if I were single, I would have gone for it,” writes a user on the app Tea about a young man named Rae. The comment appears on a TikTok video in which the author says, “The FBI work just got SO much easier for the girlies around the world.”

This excitement is the product of a new women’s-only application that describes itself as a “dating safety platform.” Tea allows users to check whether a suitor has a criminal past or uses fake photos, and also to read other women’s anonymous opinions on him. Some of these features require a monthly subscription. Created in 2023, and for the moment only available in the United States, its popularity took off this week in an unusual manner. Its users have abruptly doubled to more than 4.6 million, which has led to attention from dark corners of the manosphere, and a hacking that took place last Friday.

According to the company, the hack led to 13,000 user selfies being leaked. “If you sent your face and driver’s license to the Tea app, it publicly doxed you!” writes one 4chan user alongside a link to the document, which is no longer available.

The story of the app, its success, and the resulting leak can teach us several crucial lessons about the advantages and risks of the internet today.

1. The success of a women’s-only app

Flirting has become much easier with the rise of the internet. But not all of us experience it in the same way: 57% of women think that apps are not a safe way to find a partner, according to a Pew Research survey. Black women and those with lower levels of education are more like to consider them dangerous.

Sean Cook, the founder of Tea, says the idea for the app came to him after seeing his mother go through a “terrifying experience with online dating — not only being catfished but unknowingly engaging with men who had criminal records,” according to the app’s website.

Lack of prior knowledge about people one meets online and long strings of bad dates have made the search for information about potential partners all the more important. An app like Tea fills a hole previously served by Facebook groups like “Are We Dating The Same Guy?”

Such services appears to be a worldwide necessity. A Spanish user commented on one of the app’s TikTok videos, “I neeeeed this in Spain! I’m going to spill the tea about my super toxic ex.” The app’s account responded, “We are working on launching internationally, please stand by.”

2. The rise of misogynist message boards

Access to the app requires a woman to upload a selfie. The review system is likely conducted by a mix of AI and humans, in suspicious cases. Authorization of a new profile can take hours, but users can jump the line by recommending the app to friends. This system, along with appearances on television and in Cosmopolitan, plus a couple of TikTok and Instagram videos, led to an explosion in Google searches for the app in July.

With all the hype, Tea became the #1 most-downloaded app in the United States last week. That was when news of the sensation reached 4chan and its army of spurned men.

The leak was technically a hacking. One of the company’s developers had left open an online database containing information pre-February 2024. All that was needed for access was its exact location. Although viral posts claim that “all Tea users” have been revealed, that’s not the case. It’s only a small percentage — which doesn’t diminish the gravity of the incident nor the risk posed to the women whose data was exposed.

3. No one knows who you are online

Here’s where the unanswered questions begin. The company says when it asks for a user’s selfie, “don’t worry, we immediately erase it.” But the leaked photos are those very selfies. So, do they actually save them? “This information was stored in accordance with law enforcement requirements related to cyber-bullying investigations,” says the company’s statement. Unfortunately, an app that is highly concerned with online abuse up being harnessed by abusers.

In 2023, Tea requested a document in addition to the selfie to verify that every woman was who she said she was. The app has since discontinued this practice. It’s not hard to take a selfie (the app requires it be done in the moment, using the phone’s front camera) of another woman, or to modify the image. Compounding the risks involved, a sketchy market has sprung up of men who pay to know what is being said about them on the platform.

4. “Information wants to be free”

The value of an online database is equivalent to the time and money that someone will spend on breaking into it. A tool for protection from online assault that requires that women upload selfies becomes a juicy target for misogynist men’s message boards like 4chan, many of whose users have ample free time and knowledge of computer systems. The resulting conundrum speaks to issues surrounding our identities online: how can an app for women be designed without verifying that its users are indeed women? There is no easy answer. Similar episodes have taken place involving apps with minimum age restrictions on certain services.

5. Widespread surveillance is a dangerous concept

Tea’s dilemma harkens to another temptation of our age: widespread surveillance. What human can resist viewing the ranking of our neighbors, friends, family members? Users on the app vote on whether someone is a “red flag” or “green flag,” and leave comments like “Avoid this man!! He has mouth herpes and STDs. He lies to get what he wants then will ghost you after,” as relayed by an article in The Times. Another comment: “Abusive, pathological liar, manic and victim mentality. Loves drama.” And another: “Will emotionally and physically abuse women. Secret life with gay older men.”

The app allows users to view photos of men in their area. Although it uses only first names, several of their photos appear, and comments on them can be read. It is easy to imagine other uses for this kind of surveillance: the married woman who logs in to see if anything has been said about her husband, the human resources manager who tracks her job candidates. Users can even set up alerts with a particular man’s name and view private details such as addresses and phone numbers, which borders on practices of dubious legality.

Where can the line be drawn between harmful and helpful monitoring? The Tea leak shows we have a lot to learn when it comes to making the internet a safer place.

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition