0

I own a YouTube channel and a website that belongs to it. On the website, I am also displaying the YouTube videos. For various reasons, I want to create a plugin to sync the comments on my YouTube channel with my website. This would mean saving those comments in my database.

Are there any legal implications to this? Privacy problems maybe? Can I get into trouble?

Im from Europe, The Netherlands

1
  • Why are people downvoting this without telling me what the issue is? Im new here, if i need to adjust anything i will Dec 7, 2022 at 12:23

2 Answers 2

3

Probably not.

There are potential problems on the levels of copyright, data protection, and the Youtube terms of service.

You should assume that comments are typically covered by copyright. You do not have a license to these comments, only YouTube does. Therefore, YouTube can show the comments but you can't copy them – just like YouTube can stream your videos but others can't download them and host them on their own websites. To cover the copyright angle, you'd either need to obtain a license from the commenters, or get a sub-license from YouTube, or identify a suitable copyright exception.

The comments are personal data within the meaning of the GDPR, so that your processing of these comments (including mere storage) would be subject to GDPR as well. You need a legal basis for processing personal data. Which legal basis is suitable would depend on the purpose of processing, and on your relationship with the commenters. Potentially applicable legal bases in this context:

  • you have a contract with the commenters that requires you to show the comments on your website. For example, I could see such a contract if there were a “featured comment” perk for a Patreon subscription. But this is not going to fly with random commenters.

  • you have a legitimate interest (LI) that allows the processing. A LI requires that you conduct a balancing test where you weigh this interest against the commenter's rights. This is very specific to the purposes for which you want to show the comments. However, a LI will generally only apply if you have an existing relationship with the commenters, making it possible for them to expect that this processing will occur – unlikely if you'll be scraping comments from YouTube.

  • you have obtained consent from the data subject. Consent must be specific, informed, freely given, and unambiguous – you can't obtain consent by writing “by commenting under this video you consent to XXX” in the video description.

Regardless of legal basis, you would have to inform the commenters under Art 14 GDPR when you scrape their comments from the platform.

Finally, consider the platform terms of service. I have not read the YouTube ToS recently, so I don't know what their specific conditions are. But in general, such ToS will not allow you to scrape content from their platform in order to host it somewhere else. The ToS might allow certain actions like embedding a link/iframe to such videos on other sites, without allowing other actions such as copying other user's content to your site.

5
  • Thanks for the response. Are u sure the comments themselves, without usernames, fall under GDPR? In that case indeed this project is dead Dec 7, 2022 at 12:16
  • @SamuëlVisser Even if there were no GDPR concerns, there would be the copyright and ToS issues. But the comments are personal data as long as they relate to an identifiable person. For example, if someone can tie your copy of the comment back to the original comment on YouTube, they'd have identified the author. It might be sensible to think more about why you want to show the comments on your website. If you want to shift your community away from the YouTube platform, there might be better ways to do that than copying comments.
    – amon
    Dec 7, 2022 at 14:00
  • @aom Ok that's a shame but clear. Thanks for the information! Dec 8, 2022 at 12:45
  • @aom I was thinking. What if i use the YouTube API to show the comments on my website directly, without storing anything in my database. That should be okay, right? Why else does YouTube even have an API to fetch comments Dec 9, 2022 at 16:07
  • @SamuëlVisser All the points still hold. If you're not concerned by copyright or data protection concerns, at least read the YouTube API developer policies very carefully to see whether your project is allowed.
    – amon
    Dec 9, 2022 at 16:46
0

Re. the previous poster's comments about Personal Data ... The UK GDPR definitions is: "‘any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person". From this description, comments added to a YouTube feed would only be classed as Personal data if they allowed a person to be identified.

Use of the comments remains problematic however since they are almost certainly captured by YouTube copyright as per the last poster's comments. You still can't use them without getting prior permission!

3
  • 1
    For the question whether the comments are personal data, it is important to consider when the data subject is identifiable. More concrete criteria for this are given in Recital 26 GDPR. We do not need to know the commenters real-world identity – the existence of a username or user ID is sufficient to identify them in this context. Even if that were not sufficient, a person is also identifiable if we can perform identification with the help of a third party (such as YouTube). The CJEU's Breyer applies this logic to show that dynamic IP addresses can be personal data.
    – amon
    Dec 7, 2022 at 10:53
  • @amon if I would omit usernames on the website, and keep purely the text. Might that be enough to not fall under GDPR? Dec 7, 2022 at 11:51
  • 1
    @Samuël Visser Almost surely not. Someone could read a comment on your web site, and then search YouTube, or your YouTube channel, and find the matching comment, and with it the user name. That is enough to identify the person who made the comment. The ability to identify a person indirectly, via another site or with the help of another person ort entity is sufficient to make the data personal under the GDPR. Dec 7, 2022 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .