I would like to create an app, which would make analyses based on user behaviors, posts, comments.

I can gather those data from sites, forums because e.g twitter and so are public websites, they are reachable easily. The tricky part is that I could show those analyses, and those analyses would be related to specific users. Just to give you an example: the top commenter user is Jeff Bezos in 2021, the user who has the most discussed under comments is Elon Musk in January 2022... I am not sure if I can use those posts from lets from different websites.

  • Twitter, Youtube, Facebook and so...

I feel the legal problem both from:

  • the websites I am gathering data,
  • and both from the user perspective, but really not sure.

To solve the user GDPR problem, I could ask for confirmation from the users', that the data would be used it could be a different story probably...

And I could even approach Twitter and other sites to request API access to the data and legal confirmation I can use... I actually see a lot of sites that are using big sites and creating statistics based on it, like:

So somehow those applications solved the legal problem of this.

  • 2
    +1. Just to note that because someone is doing it does not prove it is OK with the GDPR. Loads of the web is not obviously GDPR compliant.
    – User65535
    Jan 24, 2022 at 12:00
  • 1
    ALSO note that most forums and social media specifically ban scraping their site for any data in the ToS.
    – Trish
    Jan 24, 2022 at 14:36
  • All of this makes sense guys what you just did write.
    – czupe
    Jan 24, 2022 at 15:13

1 Answer 1


Such analyses can be legal, but are not necessarily so.

The GDPR expects that all processing of personal data is done for a clear purpose, and is covered by a legal basis. For example, the data subject's consent can be a legal basis. Alternatively, you might have a “legitimate interest” to perform the processing activity. This interest must be weighed against the interests, rights, and freedoms of affected persons. That the data subject made this information public might be a factor for a legitimate interest balancing test, but it really depends on what kinds of analyses you're going to do, what you will do with the results, and if the affected people can reasonably expect this to happen.

If your proposed processing activity is legal, you can conduct it in a GDPR-compliant manner. This will require fulfilling data subject rights. For example, the data subjects might have a right to opt out of your processing. Particularly important is the Art 14 GDPR right to be informed. Since you acquire the personal data from a third party instead of directly from the data subject, you have an obligation to inform them about your processing activities without undue delay, at the latest within one month (there are exceptions though). It is this information obligation that makes many uses of the personal data infeasible.

If you're processing this data for scientific or statistical purposes, you might enjoy some privileges. The GDPR's “purpose limitation principle” does not apply, and you might be excused from Art 14 obligations. But this is dependent on taking suitable safeguards per Art 89 GDPR.

If you see other services that analyze publicly available social media data, that could have a variety of reasons:

  • GDPR does not apply to them
  • they ignore their GDPR obligations
  • they have determined that they have a suitable legal basis for their processing activities

For example, TwitchTracker.com clearly ignores GDPR (no privacy notice), but this may be legal if they aren't subject to GDPR in the first place. If they had tried to comply with GDPR, I think they would have a solid “legitimate interest” argument for allowing to perform this service. But if I were running this service, I would make sure to only aggregate publicly available data from Twitch, so that all streamers I'd be collecting data on have willingly entered the public sphere.

I would be more concerned about publishing statistics on ordinary users, unless they can reasonably expect to be singled out like this.

  • Wow this is really an amazing answer... Super detailed much more than I expected. Are you ready maybe at some point in the near future to consult further any specific matters obviously I would appreciate your help materially as well. (Hope not against stack exchange conditions to direct contact with you in the future as well)
    – czupe
    Jan 26, 2022 at 21:00
  • Yes, we can say twitchtracker statistics is anonymous so not really related to any user, from the other hand my planned application or site statistics would be related to specific users as well, and we could drawn trends and important information from those specific data related to specific users.
    – czupe
    Jan 26, 2022 at 21:02
  • And I need to understand this point much deeper, better I feel: "The GDPR's “purpose limitation principle” does not apply, and you might be excused from Art 14 obligations. But this is dependent on taking suitable safeguards per Art 89 GDPR."
    – czupe
    Jan 26, 2022 at 21:02
  • 1
    @czupe (1) I don't do compliance consulting. I'm a researcher/engineer, not a lawyer. (2) TwitchTracker statistics are not anonymous in the GDPR sense. They are clearly personal data as they relate to identifiable natural persons, identified by the Twitch username. (3) Art 89 provides special privileges e.g. for scientific research. Depending on the context, it's possible to conduct a study with existing data without having to notify everyone that their data was used. These privileges can also apply when compiling statistics, but I don't think per-user statistics count for this.
    – amon
    Jan 26, 2022 at 22:56
  • About consulting (1): yes, makes sense, you were just quite much detailed and insightful I thought you are having this profession. Thanks for the transparency. (2) Yes, again, you were right, I only checked that site games stats and not user, subscriber stats, but it looks like everything is there grouped by usernames and so... Also the page states it is not related or affiliated to Twitch or Amazon. So probably, potentially they did not have the consent from the data protector, gatherer sites, or the users as well :( I cannot really believe this is compliant at all.
    – czupe
    Jan 28, 2022 at 21:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .