Being social? What’s happening with your personal data?
INSIGHTS
When you use any one of the countless social media platforms available these days, you provide their operators with various different elements of your personal data. Before you log onto your social media platform of choice and begin scrolling, do you ever take a few minutes to read their privacy policies? Do you know what data they are gathering, and what you’re permitting them to do with it?
Although it is easy to be put off reading these policies by their sheer size and often complex legal and technical jargon (whether that is compliant from a consumer law point of view is another question), it is important to know exactly what information you are providing when you use one of these platforms, what they do with it, and who they share it with. Although the Data Protection Act 2018 does provide a degree of comfort for those using social media in the UK, you may be surprised to discover the extent to which social media platforms are being given free rein by you to use your data for their own benefit.
Below we have set out the most important takeaway points from the policies of the foremost social media platforms, setting out who owns the content that you upload to the sites in question, the data they collect and what they do with that data.
Often missed by business is the need to supplement what these platforms say by including a short business specific privacy policy on their own profile pages, as businesses will likely make their own uses of information gathered via these platforms, over and above the use made by the platforms themselves.
Who owns what you post? | What personal data they collect, and what can they do with it? |
Twitter’s User Agreement can be found here: https://twitter.com/en/tos#intlTerms Note: the following information only applies to those living in the EU, EFTA States, or the United Kingdom. Section 3 provides that: “[you] retain your rights to any Content you submit, post or display on or through” Twitter. “[You] own your Content (and your incorporated audio, photos and videos are considered part of the Content).” However, by submitting content to the site, you simultaneously grant Twitter: “a worldwide, non-exclusive, royalty-free license (with the right to sublicense) to use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute such Content in any and all media or distribution methods now known or later developed.” This wide-ranging license also allows Twitter to make your content available to the rest of the world, including other companies, organisations and individuals for broadcast, distribution and publication, for no compensation.
| Twitter’s Privacy Policy can be found here: https://twitter.com/en/privacy Data Twitter collects Twitter collects information provided in the creation of site accounts. For paid services, your payment information is collected. To create a personal account, a display name, username, password, email address and phone number is required. Twitter also requires your date of birth. Other information such as location is optionally provided. For professional accounts, further professional activity related information is required. When you use Twitter, Twitter collects data on:
Even if you have not signed in or created an account, Twitter can collect the information about your device mentioned above, including access times, the pages you visit, your location, your mobile carrier and the terms you search for, amongst other things. Twitter will also collect data on the advertisements you interact with, and your interactions with third-party websites. Importantly, other online services may share information with Twitter, such as browser cookie IDs, mobile device IDs, email addresses, demographic or interest data, and the content you view, and Twitter may collect and use that data How Twitter uses your data Twitter will use your data for help identify you. Twitter is able to associate your signed out device or browser with other browsers or devices, and can associate your account with other email addresses based on common components. When you access the site without signing in, Twitter may also identify you through the information you have given. Twitter also uses your information to:
When your data is shared by Twitter Twitter shares your information in a range of situations. When you tweet and share content, Twitter shares this information with the general public, with other site users, and, depending on your settings, with its partners. Twitter will also share your information with third parties in the following circumstances:
|
Who owns what you post? Reddit’s User Agreement can be found here: https://www.redditinc.com/policies/user-agreement-september-12-2021#EEA Note: the following information only applies to those living in the EEA, United Kingdom, and Switzerland. Section 5 provides that you retain any ownership rights you have in the content submitted to Reddit, but you grant: “a worldwide, royalty-free, perpetual, irrevocable, non-exclusive, transferable, and sublicensable license to use, copy, modify, adapt, prepare derivative works of, distribute, store, perform, and display Your Content and any name, username, voice, or likeness provided in connection with Your Content in all media formats and channels now known or later developed anywhere in the world.” This license also allows Reddit to provide what you post to its affiliates for their use (broadcast, publication etc.) and to remove any metadata associated with what is posted. As the license includes a waiver of your moral rights, you cannot require attribution for your content or object to derogatory treatment of it.
| What personal data they collect, and what can they do with it? Reddit’s Privacy Policy can be found here: https://www.reddit.com/policies/privacy-policy Data Reddit collects Reddit collects your username and password if you choose to create an account, which is optional. If you choose to create an account, Reddit may collect data on your interests, communities you want to join, gender, age or location. These details are, however, all optionally provided and can be removed at later dates. Content submitted to Reddit (including posts, comments and messages) is collected, as are the actions you take on the platform such as voting, saving and reporting content, and interactions with users and communities. Your name, address, email address and phone number are collected with reference to any purchases you make on the site. Your IP address, browser type, operating system, pages visited and device information are among the data collected automatically during your use of the platform. IP addresses are deleted by Reddit 100 days after collection, except the one you used to create an account. Cookie data is also collected by Reddit. Location data can be shared with Reddit, or Reddit may approximate a location based on your IP address. Interest or demographic information may be sourced by Reddit from third parties such as advertisers, though these settings can be modified by you upon the platform. When embedded content (such as a Youtube video or a tweet) from another platform on Reddit, the other platform may collect data relating to this, Reddit does not control how these services collect your data. Third party service providers are however used by Reddit to measure audiences and collect demographic information through the cookie data you provide. How Reddit uses your data Reddit uses the data you provide to:
When your data is shared by Reddit Reddit will in certain instances share your data with third parties. These instances include but are not limited to:
|
Who owns what you post? Linkedin provides a video on who owns the content you post on their site, found here: For detailed info on ownership of site content, the User Agreement must be consulted: https://www.linkedin.com/legal/user-agreement Section 3.1 provides that: “you own the content and information” posted on LinkedIn. However, upon signing up you also grant LinkedIn and its affiliates a non-exclusive license allowing them to: “use, copy, modify, distribute, publish and process, information and content that you provide through our Services and the services of others, without any further consent, notice and/or compensation to you or others.” This license can be transferred and sublicensed by LinkedIn, and LinkedIn can edit the content so long as they do not alter its original intended meaning. This license can be terminated with regard to specific content by deleting that content from the site or by closing your account. Your consent must be obtained by LinkedIn for usage of your content for additional purposes (such as for use in advertisements by third parties).
| What personal data they collect, and what can they do with it? LinkedIn’s Privacy Policy can be found here: https://www.linkedin.com/legal/privacy-policy#data Data LinkedIn collects LinkedIn collects an extensive amount of your data. Upon registration, it collects your name, email address and/or mobile number. The amount of data collected in the process of profile creation is dependent upon your choices as a user, and this may include your education history, work experience, address book contacts, and location amongst other things. LinkedIn may also collect data provided by you or others when making posts, sending messages, or when others sync their contacts or calendars with LinkedIn’s services. LinkedIn also collects data regarding your usage of their affiliates’ services, such as Outlook. When you use LinkedIn’s services, your usage data is logged. This includes when you click on or simply view content or advertisements, when you search on the site, or apply for jobs. Cookies, log-in data, device information and IP addresses are used in this regard to log your use. For users located outside of the EU, EEA and Switzerland, LinkedIn can track your device information (including IP address, operating system and browser information) through the use of cookies. When you go to or from LinkedIn , LinkedIn collect the URL of both the site you came from and the one you go to and the time of your visit, while also collecting data on your network, device and location (if you have opted in to location tracking). Data on when you send, receive or read messages is also collected by LinkedIn . How your LinkedIn uses your data LinkedIn uses the data you provide:
When your data is shared by LinkedIn LinkedIn will in certain instances share your data with third parties. These instances include but are not limited to:
|
Meta (Facebook/ Instagram)
Who owns what you post? Facebook’s Terms of Service can be found here: https://www.facebook.com/legal/terms Section 3 provides that: “you retain ownership of the intellectual property rights (things such as copyright or trademarks) in any such content that you create and share on Facebook.” However, for Facebook/Meta to provide their services they need a license to use this content. When you share, post or upload content, you grant them a non-exclusive, transferable, sub-licensable, royalty-free and worldwide licence to host, use, distribute, modify, run, copy, publicly perform or display, translate and create derivative works of your content (consistent with your privacy and application settings). This licence will end when your content is deleted from their systems. You can delete content that you share, post and upload at any time. All content posted to your personal account will be deleted if you delete your account. Instagram’s Terms of Use can be found here: https://help.instagram.com/581066165581870 Instagram do not claim ownership of your content but you grant a licence for them to provide the service. When you share, post or upload content, you hereby grant Instagram a non-exclusive, royalty-free, transferable, sub-licensable, worldwide licence to host, use, distribute, modify, run, copy, publicly perform or display, translate and create derivative works of your content (consistent with your privacy and application settings). This licence will end when your content is deleted from their systems.
| What personal data they collect, and what can they do with it? Meta’a Privacy Policies for Facebook and Instagram can be found here: https://www.facebook.com/privacy/policy/ https://privacycenter.instagram.com/policy Data Facebook/Instagram collect To create a personal account, you need to provide your name, email address, phone number and date of birth. They collect details on your activity including:
This includes how you interact with them and the you interact with most, such as when someone likes your content or sends you a message. If you chose to upload or import your contacts then Facebook and Instagram may suggest connections to make. They also collect data on your device and its settings (including, but not limited to, its device, IP address and information that has been shared through device settings such as GPS, camera access etc.) Facebook and Instagram collect and receive information from partners, measurement vendors, and third parties about a variety of your activities on and off their platform. This includes, but is not limited to, apps you use, purchases you make and ads you interact with. How Facebook/Instagram use your data Facebook and Instagram use the data you provide:
When your data is shared by Facebook/Instagram Information with the public is shared such as your user name or your profile if you have a public profile on Facebook/Instagram. Additionally information is shared in a range of other situations, such as:
|
Snapchat
Who owns what you post? Snap Group Limited’sTerms of Service can be found here: Section 3 provides that once you upload content on Snapchat you retain whatever ownership rights you had to begin with but you grant Snapchat a licence to use that content. How broad that licence is depends on which services you use and which services you use and settings you have selected. For all content you submit, you grant Snapchat and their affiliates a worldwide, royalty-free, sub-licensable, and transferable licence to host, store, cache, use, display, reproduce, modify, adapt, edit, publish, analyse, transmit, and distribute that content. This licence is for the purpose of operating, developing, providing, promoting, and improving the services and researching and developing new ones. This licence includes a right for them to make your content available to, and pass these rights along to other service providers with whom they have contractual relationships, solely for the purpose of providing such services. However, this differs for story submissions being “Public Content” you set as viewable to everyone as well as content you submit to public services, like Public Profiles, Snap Map, or Lens Studio. Because Public Content is inherently public, you grant Snap, their affiliates, other users of the services, and their business partners all of the same rights you grant for non-Public Content, as well as an unrestricted, worldwide, royalty-free, irrevocable, and perpetual right and licence to create derivative works from, promote, exhibit, broadcast, syndicate, reproduce, distribute, synchronise, overlay graphics and auditory effects on, publicly perform, and publicly display all or any portion of your Public Content (including the separate video, image, sound recording, or musical compositions contained therein) in any form and in any and all media or distribution methods, now known or later developed. When you appear in, create, upload, post, or send Public Content (including your Bitmoji), you also grant Snap, their affiliates, other users of the services, and their business partners an unrestricted, worldwide, royalty-free, and irrevocable right and licence to use the name, likeness, and voice, of anyone featured in your Public Content. This means, among other things, that you will not be entitled to any compensation if your content, videos, photos, sound recordings, musical compositions, name, likeness, or voice are used by them, their affiliates, users of the services, or their business partners.
| What personal data they collect, and what can they do with it? Snap Group Limited’s Privacy Policy can be found here: https://values.snap.com/en-GB/privacy/privacy-policy What do they collect? To create a personal account you need to provide your name, username, password, email address, phone number and date of birth. Other information such as a profile picture or bitmoji can be optionally provided. Snap collects data on:
Additionally snapchat collects information about you from other users, their affiliates and third parties. How Snap uses your data Snapchat uses your information to:
When your data is shared by Snap
Snapchat may also share information for legal, safety and security reason.
|
TikTok
Who owns what you post? TikTok’s Terms of Service can be found here: https://www.tiktok.com/legal/page/eea/terms-of-service/en TikTok do not own your content. If you are the owner of the intellectual property rights in the content that you make available on the platform, then nothing in the terms changes that. To provide the platform, TikTok requires a licence from you. By creating, posting or otherwise making content available on the platform, you grant TikTok a non–exclusive, royalty free, transferable, sublicensable, worldwide licence to use your content, including to reproduce, adapt of make derivative works (e.g. to display it) for the purposes of operating, developing and providing the platform, subject to your platform settings. This licence granted to TikTok also extends to affiliates as part of making the platform available. Your licences to TikTok and to users end when you close your account or when you or TikTok remove your content from the platform. However, due to the nature of the platform and their legal obligations, the licence granted will continue after you have removed your content to the extent that:
| What personal data they collect, and what can they do with it? TikTok’s Privacy Policy can be found here: https://www.tiktok.com/legal/page/eea/privacy-policy/en Data TikTok collect
How TikTok uses your data Tiktok uses your information to:
When your data is shared by TikTok TikTok shares your information with:
|
Given the degree of media attention to social media platforms’ use of user data in recent years, data regulation is of course a hot topic for legislators, with multiple recent developments and likely upcoming changes.
United Kingdom
As part of the UK’s National Data Strategy, the UK Government has sought to install a trusted data regime that is conducive to economic growth and innovation, first and foremost by means of its proposed Data Reform Bill, expected to be passed into law at some point in 2023. The bill proposes to free up the use of data by, amongst other things, limiting the scope of “personal data”; amending the ability to use personal data for “legitimate interests” in the interests of scientific research and the public sector; and easing the requirements for the use of cookies online.
While the intended goal of this proposed legislation is to deliver on the aims of the National Data Strategy and make life easier for smaller businesses by removing red tape, critics have argued that it will do the opposite, effectively forcing companies doing business both in the UK and EU to operate under two separate data regimes. Proponents of the bill, such as the former Minister for Media, Data and Digital Infrastructure Matt Warman, have claimed that the more likely practical result will be the maintenance of a free flow of personal data from the EU and will enable partnerships on a worldwide scale.
European Union
The long-running controversy regarding the security of user data on TikTok – which has included calls from the US to ban the app – has recently been addressed by the European Commission, with European Commission Vice President calling on the Chinese social media giant to respect the laws of the EU and maintain the safety of European users’ data.
These comments coincided with a meeting between Tiktok’s CEO, Shou Zi Chew, and the European Commission in Brussels, and they come after the launch of two investigations by the Irish data protection regulator, one into potentially unlawful transfers of European user data to China and the other on children’s privacy.
United States
2022 saw the introduction of a more robust data protection regime in the US by means of a presidential executive order, which seeks to create a framework providing sufficient safeguards for personal data in line with the ECJ’s decision in Schrems II. Included are mechanisms created to limit surveillance agencies’ access to data as well as a tiered redress mechanism to handle complaints. Decisions will be made in the coming months by the UK and EU on the adequacy of this new regime, which will hopefully allow for the free movement of personal data between the US and the UK and EU.
China
Last year, China introduced a host of new data export regulations which have been highlighted as potential barriers for cross-border data flow for legitimate business operations. The most problematic areas of the rules include a requirement for overseas “core” data transfers to go through a security review process before receiving the required permissions and a requirement for companies who are qualified to transfer data across borders to record their “Standard Contractual Clauses and their privacy impact assessment report” with regulators before transferring data out of China. Commentators have claimed that such rules may jeopardise China’s position at the forefront of digital trade and manufacturing.
About the authors
Solicitor
RELATED
Brand management
Take two: The law behind artists re-recording their music
Commercial & Regulatory
Copyright protection beyond the author's lifetime
Intellectual property & technology
Regulating artificial intelligence: The EU AI Act
Intellectual property & technology
Dua Lipa’s Levitation Litigation
Intellectual property & technology
Artists leading the fightback against the proliferation of AI
Intellectual property & technology
The use of artificial intelligence in the publishing industry
Intellectual property & technology
Ed Sheeran and the blurred lines around copyright infringement claims
Technology
The potential risks of using ChatGPT at work
CONTACT US
Call us for free on 0330 912 0294 or complete our online form below for legal advice or to arrange a call back.