Guidelines 08/2020 on the targeting of social media users – version for public consultation

Section 4.2  Social media providers

20 Social media providers offer an online service that enables the development of networks and communities of users, among which information and content is shared. Social media services are typically offered through web browsers or dedicated apps, often after having requested the user to provide a set of personal data to constitute the user’s “account” or “profile”. They also often offer users associated account “controls”, to enable them to access and control the personal data processed in the context of the use of their account.

21 The social media provider determines the functionalities of the service. This in turn involves a determination of which data are processed, for which purpose, under which terms, as well as how personal data shall be processed. This allows for the provision of the social media service but also likely the provision of services, such as targeting, that can benefit business partners operating on the social media platform or in conjunction with it.

22 The social mediaprovider has the opportunity to gather large amounts of personal data relating to users’ and non-registered users ́ behaviour and interactions, which enables it to obtain considerable insights into the users’ socio-demographic characteristics, interests and preferences. It is important to note that the ‘insights’ based on user activity often involve inferred or derived personal data. For example, where a user interacts with certain content (e.g. by “liking” a post on social media, or watching video content), this action can be recorded by the social media provider, and an inference might be made that the user in question enjoyed the content he or she interacted with.

23 Social media providers increasingly gather data not only from activities on the platform itself, but also from activities undertaken ‘off-platform’, combining data from multiple sources, online and offline, in order to generate further insights. The data canbe combined with personal data that individuals actively disclose to the social media provider (e.g. a username, e-mail address, location, and phonenumber), alongside data which is “assigned” to them by the platform (such as unique identifiers).