In the preface to the changes, Instagram is quick to point out two important details -- users still choose who can see their Instagram photos, and they still get to choose whether they post photos on Facebook.
That said, the new policy introduces the notion of "affiliates" (not present in the old privacy policy), which, we presume, primarily means "Facebook".
From the new policy:
"We may share User Content and your information (including but not limited to, information from cookies, log files, device identifiers, location data, and usage data) with businesses that are legally part of the same group of companies that Instagram is part of, or that become part of that group ("Affiliates"). Affiliates may use this information to help provide, understand, and improve the Service (including by providing analytics) and Affiliates' own services (including by providing you with better and more relevant experiences). But these Affiliates will honor the choices you make about who can see your photos."
This bit is absent from the old policy, which only mentions sharing of user data with "service providers" and (to an extent) with third-party advertising partners.
The changes are hardly unexpected -- Facebook is a company that lives and breathes user data and with Instagram under its wing, it obviously wants to be able to use the data from its user base as well. The changes may not sit well with Instagram users who don't use and/or don't care much about Facebook, however.
The new privacy policy is effective Jan. 16, 2013.
Image courtesy of iStockphoto, SimmiSimons