Under the European Union's new General Data Protection Regulation, Instagram and its parent company, Facebook, must be clear about the kinds of information they collect about users and why they're collecting it.
In its notification to users, Instagram explained: "We receive different kinds of information from your device, like how you tap and scroll, which can help distinguish humans from bots and detect fraud."
It appears Instagram first notified users about the tracking in a policy update last month.
The idea that Instagram is keeping tabs on everything its users tap on is unnerving — but from the company's perspective, there is a good explanation.
Instagram has acknowledged having a bot problem. In 2015, a group of researchers estimated that up to 8% of all Instagram accounts were fake. And The New York Times reported last year on a cottage industry of companies that automatically like, follow, and comment on Instagram on behalf of their clients' accounts.
The company began cracking down on bots a year ago when it closed down Instagress, a popular automated-like-and-comment service.
Last year, Instagram also debuted artificial-intelligence tools designed to fight trolls and spam. Instagram is probably using the trove of user-behaviour data that it collects to train its AI to recognise human profiles versus bot-controlled accounts to determine which are most likely bots, then take appropriate action.
Instagram did not immediately respond to Business Insider's request for clarification.