In a joint statement, the UK’s Information Commissioner’s Office (ICO) — in collaboration with data protection and privacy authorities from non-EU member countries such as Australia, Canada, and Hong Kong — have urged social media companies to protect users’ data from unlawful data scraping.

The twelve regulatory bodies wrote that social media companies have data protection obligations regarding third-party scraping from their sites, and that the “obligations will generally apply to personal information whether that information is publicly accessible or not.” Further, “mass data scraping of personal information can constitute a reportable data breach in many jurisdictions.”

In light of this, the authorities advised social media companies and other public websites to “carefully consider” the legality of various kinds of data scraping within their relevant jurisdictions, and in response implement measures to protect and counteract against unlawful scraping of data.

The call comes amid increased reports of mass data scraping from social media platforms and others websites that host publicly available data and information. It also coincides with the intensified interest in and usage of artificial intelligence tools, which usually need vast amounts of data for training. However, the statement doesn’t specifically cite artificial intelligence as one of the reasons underpinning the increase in socia media scraping reports.

The regulators also underscored several privacy concerns on this front, including the use of scraped data for targeted cyber-attacks which leverage social engineering or phishing methods, as well as identify fraud and impersonation, unauthorised political or intelligence gathering purposes, and unwanted direct marketing or spam.

More broadly, the regulators are concerned that mass data scraping means that individuals lose control of their personal data and information when it’s scraped without their knowledge and against their expectations. “For example, data scrapers may aggregate and combine scraped data from one site with other personal information, and use it for unexpected purposes. This can undermine individuals’ trust […] with potentially detrimental impacts on the digital economy,” they wrote.

To protect individuals’ personal data and information and from the associated privacy harms, the regulators proposed a multi-layered mitigative approach. For instance, deploying CAPTCHAs to detect bots and blocking IP addresses, rate limiting the number of visits per hour or day by one account to other account profiles, and implementing an in-house team or specific roles to monitor and respond to scraping activities are just some of the suggested actions that social media firms can take.

The regulators stipulated that their joint statement and the advice within it was sent directly to many big tech companies owning well-used social media platforms. These include Alphabet Inc. (YouTube), ByteDance Ltd (TikTok), Meta Platforms, Inc. (Instagram, Facebook and Threads), Microsoft Corporation (LinkedIn), Sina Corp (Weibo), and X Corp. (X, formerly known as Twitter).

The authorities also offered advice that can be taken on an individual level, as to help users minimise the privacy risks from data scraping. This includes reading how social media companies and other sites share personal information, including their privacy policies, and being cautious about sharing sensitive information that may put them at risk of threats such as identity fraud and theft.

Recommended reading

• TikTok to Face EU GDPR Fine Over Processing Children’s Data
• Users Want More Fact-checking From Social Media Networks
• EU Warns Tech Companies to Comply with Digital Services Act

Speaking on the statement’s publication, Stephen Bonner, the ICO deputy commissioner for regulatory supervision, said: “This joint statement helps provide certainty, and consistency across borders, in how data protection applies to information people post online. Organisations must have a lawful reason for collecting and using people’s data, even when it is publicly available.

“Social media companies have obligations under UK data protection law to protect the information people post on their platforms.

“We are seeing increased reports of mass data scraping from social media and remind organisations that such incidents may require reporting to the ICO as a personal data breach.”