The Information Commissioner’s Office, as well as several global counterparts, are highlighting how social media companies can better protect personal information, as concerns grow about mass scraping of personal data within social media platforms, often to support AI models.

The ICO has joined 16 other global data protection authorities engaged with some of the world’s largest social media companies after issuing a joint statement on data scraping last year. As a result of this engagement, they have now issued a follow-up statement laying out additional takeaways for industry.

As AI models continue to proliferate across various systems, and need more and more data to train themselves, data scraping has become of utmost concern for data privacy. Social media platforms continue to roll out their own AI models, often scraping the data of their users to train the AI systems.

Last year, data protection authorities called on industry to identify and implement controls to protect against, monitor for, and respond to data scraping activities on their platforms, including by taking steps to detect bots and block IP addresses when data scraping activity is identified, among other measures.

As Meta and X begin training their AI models on their user data, which faced some controversy from data protection authorities, the new joint statement lays out further expectations to safeguard user data.

The statement says that organisations must comply with privacy and data protection laws when using personal information, including from their own platforms, to develop AI large language models (LLMs).

A combination of safeguarding measures and regular review must be deployed to keep pace with advances in scraping techniques and technologies.

Organisations are also urged to ensure that permissible data scraping for commercial or socially beneficial purposes is done lawfully and in accordance with strict contractual terms.

After the first statement was signed by members of the Global Privacy Assembly’s International Enforcement Working Group in 2023, it was sent to the parent companies of YouTube, TikTok, Instagram, Threads, Facebook, LinkedIn, Weibo, and X.

According to the ICO, this led to constructive dialogue between data protection authorities and several of these social media companies, as well as with the Mitigating Unauthorised Scraping Alliance, an organisation that aims to combat unauthorised data scraping.

Recommended reading

• Demystifying GDPR & AI: Safeguarding Personal Data in the Age of LLMs
• X Facing 9 GDPR Complaints Over AI Data Scraping
• Is There an Ethical Solution to AI Data Scraping?

The discussions enabled all parties to delve deeper into the issues related to data scraping, resulting in a more nuanced and robust understanding by data protection authorities of the challenges that organisations face in protecting against unlawful scraping, including increasingly sophisticated scrapers, ever-evolving advances in scraping technology, and differentiating scrapers from authorised users.

Generally, social media companies indicated to data protection authorities that they have implemented many of the measures that were identified in the initial statement, as well as further measures that can form part of a dynamic multi-layered approach to better protecting against unlawful data scraping.

Some of the additional measures that are presented in the follow-up joint statement include using platform design elements that make it harder to scrape data using automation, safeguards that leverage artificial intelligence, and lower cost solutions that small and medium-sized enterprises could use to meet their safeguarding obligations.