Public data counts too
Data made public by people is still personal data.
Social listening and GDPR
Listen to conversations, respect people.
Social listening and mention monitoring often process personal data, even when it is public: that is why the GDPR applies. Find out which principles matter, which legal basis is used and how to document your choices. A practical guide, not legal advice.
In brief
Social listening and GDPR: the essential rules.
A public post with a name, a photo or a profile contains personal data. Collecting and analysing it is processing: it needs a clear purpose, a legal basis, the minimum necessary and defined retention periods.
Topics, not people
The analysis looks at aggregated topics, not at individual authors’ profiles.
Documented choices
Purpose, legal basis and retention written down before starting.
The principles
Four GDPR principles applied to listening.
Article 5 of the GDPR sets the principles of every processing operation. In conversation monitoring, four of them decide almost everything.
| Principle | What it asks | How to apply it |
|---|---|---|
| Purpose limitation | Collect for specific, declared purposes. | A business question written before collection. |
| Data minimisation | Only the data necessary for the purpose. | Text and date yes; full author profiles no. |
| Storage limitation | Keep data only as long as necessary. | A defined duration, then deletion or aggregation. |
| Integrity and confidentiality | Protect the data collected. | Limited, logged access; no scattered copies. |
The legal basis
Legitimate interest, assessed in writing.
For analysing public conversations for market purposes, legitimate interest is usually used (Article 6(1)(f)). It must be balanced against people’s rights and documented in an assessment.
When data is not collected from the data subject, Article 14 of the GDPR requires information to be provided, with the exceptions in paragraph 5, for example when informing each person would involve disproportionate effort: in that case appropriate measures are needed, including making the information publicly available. For large-scale processing, Article 35 may require a data protection impact assessment.
An example legitimate interest assessment for a fictional brand’s social listening project, with purpose, necessity, balancing and safeguards.
Legitimate interest assessment · example project
- Purpose
- Understand recurring doubts about products before purchase.
- Necessity
- Public conversations are the direct source of those doubts.
- Balancing
- Public content, analysis by topic, no decisions about individuals.
- Safeguards
- Pseudonymised authors, limited retention, public privacy notice.
What to avoid
Practices that cross the line.
The line between lawful listening and surveillance of people is crossed when attention moves from topics to individuals, or when everything is kept forever.
Four conversation monitoring practices that create data protection risks, each set against an alternative that complies with the GDPR.
| What to avoid | Respectful alternative | |
|---|---|---|
| Profiles | Keeping files on individual authors who criticise the brand. | Analyse topics, with authors pseudonymised. |
| Retention | Keeping every post forever, “just in case”. | A defined duration, then only aggregated data. |
| Special categories | Classifying authors’ health, religion or political opinions. | Exclude these categories from the analysis. |
| Private spaces | Joining closed groups to observe conversations. | Only public content, in line with platform rules. |
A compliant project
Five steps before switching on listening.
Compliance is built before collection. A few written steps make the project defensible and more useful, because they force you to clarify what is really needed.
Write the purpose
A precise business question, not “keep an eye on everything”.
Assess legitimate interest
Purpose, necessity, balancing and safeguards, in writing.
Collect the minimum
Only public content and only the fields you need.
Set retention
How long, then deletion or aggregation.
Publish the privacy notice
What you collect, why, for how long and how to object.
Frequently asked questions
Frequently asked questions about social listening and GDPR.
Whether social listening is lawful, whether consent is needed, whether authors must be informed and what to do with people’s requests.
Is social listening lawful under the GDPR?
Yes, if it has a clear purpose and a valid legal basis, collects the minimum necessary and respects people’s rights. The fact that data is public is not enough on its own.
Do you need the consent of the posts’ authors?
Usually not: for analysing public conversations, legitimate interest is used, assessed and documented. Consent becomes necessary in other cases, for example for promotional use of the content.
Do people need to be informed?
Article 14 requires information when data is not collected from the data subject. If informing each person is disproportionate, appropriate measures are needed, such as a public privacy notice.
What should you do if someone asks for erasure?
Assess the request as for any processing: verify identity, find the data and, if there are no overriding grounds to keep it, delete it and confirm.
Related paths
After “Social listening and GDPR”, the next step.
The guides explain the concepts with examples on fictional brands. From here you continue with the other guides, the methodology and the features that apply them to your brand.
Guides to reputation, trust and AI
Guides on GEO, AEO, AI visibility, online reputation, reviews and monitoring: what to check, a worked example and the steps to act.
ReadFrom question to action
How TrustInsider works in six steps: brand, questions, quote, evidence, page-by-page intervention and a check on the same questions.
ReadA transparent method, not a black box
How every TrustInsider measure is built: sampling of AI answers, sources and rights, index calculation and declared limits.
ReadFind the right answer
Help with access, credits, collections, integrations and data: guides, FAQs, the site assistant and support requests from your workspace.
Read