Bitmoji is a secure keyboard app, but it comes with some privacy risks. One major area of concern for most users is that it requires full access permissions on your device to work.
I tested the app on Android and iOS and reviewed its privacy policy to see what data it collects and why. I also checked its history for past data breaches and privacy violations.
The best way to protect yourself when using Bitmoji is to use a VPN. I recommend ExpressVPN because it offers strong security and privacy, has easy-to-use apps for Android and iOS, and is very lightweight, so it won’t slow down your mobile device. Editors' Note: ExpressVPN and this site are in the same ownership group.
What Is Bitmoji?
Bitmoji is a third-party keyboard app that lets you create personalized avatars and stickers. More specifically, it allows you to design a cartoon-like avatar that resembles you by selecting from various facial features, outfits, and accessories. These avatars can be customized to reflect different moods, styles, and expressions, and can be made into stickers, known as Bitmojis, to share with others.
Once you’ve created your avatar, the app adds a Bitmoji keyboard onto your Android or iOS phone, allowing you to easily send Bitmojis in messaging apps by simply opening the Bitmoji keyboard and tapping on the desired Bitmoji, which is then pasted directly into the chat.
The company behind Bitmoji, Bitstrips, is owned by Snapchat (the company acquired it in 2016), which is why the app prompts you to connect your Bitmoji account to Snapchat. This integration allows you to use your Bitmoji directly within Snapchat. That said, your Bitmojis are available for use across all popular social media and messaging platforms, including WhatsApp, Facebook Messenger, iMessage, Instagram, and Discord.
Is Bitmoji Safe to Use?
Bitmoji is safe to use in the sense that it’s a legitimate app — it doesn’t contain malware, nor does it pose a direct security threat to your device. This should come as no surprise, since it’s owned by Snapchat and has integration with several other major social media and messaging platforms.
However, using the app comes with potential privacy risks. The Bitmoji app requires full access to your keyboard, which raises concerns about what kind of data the company collects, what it does with it, and whether this data is kept safe from hackers.
Using a good VPN like ExpressVPN with Bitmoji can help mitigate some of these risks. By masking your IP address and encrypting your data, a VPN makes it more difficult for third parties to track your online activities or intercept sensitive information that may be exposed while using the app.
IMPORTANT: As stated in Bitmoji’s Terms of Use, its services aren’t intended for children under the age of 13. This is because the stickers created by other users may contain mild examples of nudity, crude humor, profanity, and mature or suggestive themes. If you want to protect your kid online, check out our top parental control apps.
Editors' Note: ExpressVPN and this site are in the same ownership group.
Bitmoji Privacy Concerns
There are several areas of concern when it comes to how Bitmoji may affect your privacy. I checked what permissions it requires and why and conducted a detailed examination of its privacy policy to learn what data Bitmoji collects on you and how that data is used.
Permissions Required by Bitmoji
Bitmoji requires full access permissions on your device to work. According to Bitmoji’s website, these permissions are necessary to download custom images from its servers.
But what does “full access permissions” really mean?
On iOS, the warning message you receive when installing Bitmoji states that allowing full access means that the developer can see and transmit anything you type with its keyboard, which “could include sensitive information such as your credit card number or street address.”
You receive a similar message on Android phones when granting Bitmoji permissions, which warns you that “Bitmoji may be able to collect all the text you type, including personal data such as passwords and credit card numbers.”
This sounds horrifying, but it’s important to note that this is your phone’s default warning message for granting these permissions — it’s not specific to Bitmoji.
Bitmoji’s website claims that it can’t read or access what you type on your phone’s keyboard or a third party keyboard, and though it could technically read or access what you type on the Bitmoji Keyboard, the only text it logs is what you type when searching for Bitmojis in the app. Additionally, considering the Bitmoji Keyboard is only used to send stickers, it’s unlikely that you would be typing any sensitive data on it.
Data Collected by Bitmoji
Bitmoji collects data about you in 3 major categories, according to Snapchat’s privacy policy.
Bitmoji doesn’t have its own privacy policy so it’s not exactly clear what it can collect (obviously Snapchat as an app can collect a lot more info). However, this is what it may get its hands on based on the general privacy policy from Snapchat:
- Firstly, Bitmoji collects information that you choose to provide, including the email address or phone number that you use to log in, your date of birth, and payment and related information (if you purchase something through the app).
- Secondly, Bitmoji collects usage information, which includes what you type into the search bar when searching for Bitmojis to send (but not the actual stickers that you send and no keystroke data from any other keyboards on your phone). This may also include information about your device, such as what operating system you’re using, what apps you have installed, what browser you use, your IP address, and how and when you use Bitmoji’s services.
- The final category of information that Bitmoji collects is third-party information.This includes data that it receives if you link your Bitmoji to another service, data from advertisers, and data about other ways to contact you, such as SMS, email, or other messaging services.
Bitmoji’s Privacy Policy
The data Bitmoji collects is primarily used to deliver and maintain its services, based on Snapchat’s general privacy policy. The data is also used for research and analytics purposes, so that the company can better understand the interests of its users, spot trends, and learn how it can improve its services.
This means that in a best case scenario, the company uses the information to provide you with stickers you like and make the keyboard easier to use.
Additionally, the data may be used to personalize your experience on Snapchat, if you use the app. In other words, you’re likely to be shown content that’s more relevant to you (such as friend suggestions, place recommendations, Snapchat Spotlight content, etc.) and to be served more targeted ads based on how you use Bitmoji.
Has Bitmoji Ever Been Compromised?
Bitmoji itself has never been compromised. However, Bitmoji’s parent company, Snapchat, has been compromised multiple times over the years. Here are some of the most notable incidents:
In 2014, hackers exploited a vulnerability in the app’s “Find Friends” feature, which resulted in the exposure of 4.6 million usernames and phone numbers. And in 2019, it was reported that some Snapchat employees abused SnapLion, an internal tool designed to assist with legal requests for user data, to illegitimately access users’s locations, phone numbers, and email addresses.
What’s more, popular keyboard apps like Bitmoji aren’t exactly immune to cyber attacks — and many have been involved in major data breaches or have demonstrated serious security vulnerabilities.
In 2017, keyboard app AI.Type experienced a massive data breach that exposed the personal data of 20.6 million users, including their contacts, dates of birth, email addresses, genders, geographic locations, IP addresses, phone numbers, social media profiles, and more. And in 2024, researchers at Citizen Lab discovered security vulnerabilities across eight different keyboard apps that could be exploited by hackers to see what users type — this incident is estimated to have affected up to 1 billion users.
How to Protect Your Device & Data While Using Bitmoji
- Get a reliable VPN. A VPN encrypts your internet connection, scrambling the data so that nobody else can read it, and hides your IP address to keep you anonymous online. This is particularly important when using Bitmoji on unsecured public Wi-Fi networks, where your data can be vulnerable to interception. A top-rated VPN like ExpressVPN ensures that your personal information and Bitmoji interactions remain private and secure thanks to its many advanced security and privacy features.
- Install a good antivirus program. Antiviruses protect your device from keyloggers, a type of malware that records your keyboard inputs with the aim of stealing sensitive information, such as credit card information or passwords, and other malware that could compromise your device and data. Norton is my favorite, but there are lots of good options out there.
- Use a password manager. A reliable password manager like 1Password can generate and store complex passwords, making it easier to protect your accounts without the need to remember them all. This helps you secure your Bitmoji and related accounts with strong, unique passwords and reduces the risk of using weak or repeated passwords across multiple platforms. Here are our best-ranked safe password managers.
- Enable 2-factor authentication (2FA). Whenever possible, enable 2FA on accounts linked to Bitmoji, such as Snapchat. This adds an extra layer of security by requiring a second form of verification, like a text message code, in addition to your password, so even if a hacker obtained your password, they still wouldn’t be able to access your account unless they also had access to your phone.
- Keep your apps updated. This means Bitmoji, but also other apps that you use that integrate with Bitmoji. You should do this because app updates often include fixes to security vulnerabilities that might otherwise put your device and data at risk.
Editors' Note: ExpressVPN and this site are in the same ownership group.
Frequently Asked Questions
Should I allow Bitmoji full access?
If you want to use the app, you don’t have a choice. Bitmoji needs these permissions to download custom images from its servers. Allowing Bitmoji full access is a privacy risk, but it’s not as bad as it seems at first glance. Bitmoji can only read and access what you type on the Bitmoji Keyboard (which only sends stickers) — not on your phone’s keyboard or other third party keyboards. And Bitmoji states that the only thing it logs is what you type into the app’s search bar when looking for a sticker.
Plus, if you want extra security and privacy, you can get yourself a good VPN like ExpressVPN.
Is Bitmoji able to see everything I type?
No — while the warning message you’re shown when you grant Bitmoji full access permissions makes it sound like it can, in reality Bitmoji can only see what you type on its own keyboard. This means that sensitive information such as your credit card information or passwords are not at risk, since the Bitmoji Keyboard is only used to send stickers.
Can I trust Bitmoji?
Bitmoji is a legitimate app, so it doesn’t pose a direct security threat to your device or data. However, there are certain privacy risks associated with using the app. It requires full access permissions on your device in order to function, and like most apps on the market, it collects a certain amount of personal information about you, which may be used to target you with advertisements, among other things.
Will Bitmoji steal my data?
No more than any other company does. According to Bitmoji’s privacy policy, it collects information about you in three major categories. Firstly, it collects information you choose to provide, such as your email address or phone number. Secondly, it collects usage information, such as what you type into the Bitmoji app search bar, your IP address, and how you use Bitmoji’s services. Lastly, it collects third party information it receives from services linked to Bitmoji. That said, it’s worth noting that Bitmoji’s parent company, Snapchat, has been involved in multiple data breaches over the years.