Instagram private accounts posts including photos & videos and Stories from a private Instagram account can be shared via a web browser.
In a recent finding by Buzzfeed News, a follower of Instagram private accounts account can simply pull out the source URL of a (for example) photo from that account, by 'inspecting' the page and then share the accessible URL to anyone; even the ones who are not logged in to Instagram or do not follow that private account.
According to the report, JPEGs and MP4s from private feeds and stories can be viewed, downloaded, and shared publicly this way.
As the data is being hosted by Facebook's network, the hack applies to private Facebook content as well. Moreover, as Instagram does not track who sees your data via public URLs, if someone shares your data via public URLs, you would have no idea, who did it or how many people see it.
In a statement made to Buzzfeed, a Facebook spokesperson mentions, "The behavior described here is the same as taking a screenshot of a friend’s photo on Facebook and Instagram and sharing it with other people. It doesn’t give people access to a person’s private account."
Although the URL contains some basic information about the image such as how it was uploaded and dimensions, which the screenshot doesn't.
In another news, Facebook & Instagram's combined downloads are down 13% year over year and tracking down 3% compared to last quarter. Facebook mobile app downloads too have declined 15% year over year in the third quarter of 2019, according to a Bank of America analysis.