Such analyses can be legal, but are not necessarily so.
The GDPR expects that all processing of personal data is done for a clear purpose, and is covered by a legal basis. For example, the data subject's consent can be a legal basis. Alternatively, you might have a “legitimate interest” to perform the processing activity. This interest must be weighed against the interests, rights, and freedoms of affected persons. That the data subject made this information public might be a factor for a legitimate interest balancing test, but it really depends on what kinds of analyses you're going to do, what you will do with the results, and if the affected people can reasonably expect this to happen.
If your proposed processing activity is legal, you can conduct it in a GDPR-compliant manner. This will require fulfilling data subject rights. For example, the data subjects might have a right to opt out of your processing. Particularly important is the Art 14 GDPR right to be informed. Since you acquire the personal data from a third party instead of directly from the data subject, you have an obligation to inform them about your processing activities without undue delay, at the latest within one month (there are exceptions though). It is this information obligation that makes many uses of the personal data infeasible.
If you're processing this data for scientific or statistical purposes, you might enjoy some privileges. The GDPR's “purpose limitation principle” does not apply, and you might be excused from Art 14 obligations. But this is dependent on taking suitable safeguards per Art 89 GDPR.
If you see other services that analyze publicly available social media data, that could have a variety of reasons:
- GDPR does not apply to them
- they ignore their GDPR obligations
- they have determined that they have a suitable legal basis for their processing activities
For example, TwitchTracker.com clearly ignores GDPR (no privacy notice), but this may be legal if they aren't subject to GDPR in the first place. If they had tried to comply with GDPR, I think they would have a solid “legitimate interest” argument for allowing to perform this service. But if I were running this service, I would make sure to only aggregate publicly available data from Twitch, so that all streamers I'd be collecting data on have willingly entered the public sphere.
I would be more concerned about publishing statistics on ordinary users, unless they can reasonably expect to be singled out like this.
