circle circle
 Being social? What’s happening with your personal data?
Intellectual property & technology

Being social? What’s happening with your personal data?



When you use any one of the countless social media platforms available these days, you provide their operators with various different elements of your personal data. Before you log onto your social media platform of choice and begin scrolling, do you ever take a few minutes to read their privacy policies? Do you know what data they are gathering, and what you’re permitting them to do with it?

Although it is easy to be put off reading these policies by their sheer size and often complex legal and technical jargon (whether that is compliant from a consumer law point of view is another question), it is important to know exactly what information you are providing when you use one of these platforms, what they do with it, and who they share it with. Although the Data Protection Act 2018 does provide a degree of comfort for those using social media in the UK, you may be surprised to discover the extent to which social media platforms are being given free rein by you to use your data for their own benefit.

Below we have set out the most important takeaway points from the policies of the foremost social media platforms, setting out who owns the content that you upload to the sites in question, the data they collect and what they do with that data.

Often missed by business is the need to supplement what these platforms say by including a short business specific privacy policy on their own profile pages, as businesses will likely make their own uses of information gathered via these platforms, over and above the use made by the platforms themselves.


Who owns what you post? What personal data they collect, and what can they do with it?
Twitter’s User Agreement can be found here:

Note: the following information only applies to those living in the EU, EFTA States, or the United Kingdom.

Section 3 provides that:

“[you] retain your rights to any Content you submit, post or display on or through” Twitter. “[You] own your Content (and your incorporated audio, photos and videos are considered part of the Content).”

However, by submitting content to the site, you simultaneously grant Twitter:

“a worldwide, non-exclusive, royalty-free license (with the right to sublicense) to use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute such Content in any and all media or distribution methods now known or later developed.”

This wide-ranging license also allows Twitter to make your content available to the rest of the world, including other companies, organisations and individuals for broadcast, distribution and publication, for no compensation.








































Twitter’s Privacy Policy can be found here:

Data Twitter collects

Twitter collects information provided in the creation of site accounts. For paid services, your payment information is collected.

To create a personal account, a display name, username, password, email address and phone number is required. Twitter also requires your date of birth. Other information such as location is optionally provided. For professional accounts, further professional activity related information is required.

When you use Twitter, Twitter collects data on:

  • the content you post as Tweets, as well as your lists, bookmarks and the communities that you have joined;
  • your interactions with other users (likes, retweets etc);
  • your followers and who you follow;
  • the content of your messages, their recipients, and the time and date they are sent;
  • information contained in correspondence between you and Twitter;
  • the links you interact with;
  • your purchases;
  • your IP address and browser type;
  • your device and its settings (including, but not limited to, its device and advertising ID, operating system, language, memory and battery level); and
  • your location.

Even if you have not signed in or created an account, Twitter can collect the information about your device mentioned above, including access times, the pages you visit, your location, your mobile carrier and the terms you search for, amongst other things.

Twitter will also collect data on the advertisements you interact with, and your interactions with third-party websites.

Importantly, other online services may share information with Twitter, such as browser cookie IDs, mobile device IDs, email addresses, demographic or interest data, and the content you view, and Twitter may collect and use that data

How Twitter uses your data

Twitter will use your data for help identify you. Twitter is able to associate your signed out device or browser with other browsers or devices, and can associate your account with other email addresses based on common components. When you access the site without signing in, Twitter may also identify you through the information you have given.

Twitter also uses your information to:

  • operate, improve and personalise its services, which includes catering its advertising and content to your tastes;
  • help others find your account;
  • foster safety and security of its users, products and services;
  • measure and analyse both the effectiveness of its services and how you use them;
  • to conduct research, surveys, product testing and troubleshooting for its services.

When your data is shared by Twitter

Twitter shares your information in a range of situations.

When you tweet and share content, Twitter shares this information with the general public, with other site users, and, depending on your settings, with its partners.

Twitter will also share your information with third parties in the following circumstances:

  • with service providers for services such as payments or fraud detection;
  • with advertisers, who may collect information such as cookie identifiers and your IP address;
  • with third parties for the purpose of integrations with Twitter’s cross-platform sharing partners;
  • to comply with laws or if doing so is in the public interest;
  • with Twitter’s affiliates; and
  • in the event of a sale, merger or change in control of the company.


Who owns what you post?

Reddit’s User Agreement can be found here:

Note: the following information only applies to those living in the EEA, United Kingdom, and Switzerland.

Section 5 provides that you retain any ownership rights you have in the content submitted to Reddit, but you grant:

“a worldwide, royalty-free, perpetual, irrevocable, non-exclusive, transferable, and sublicensable license to use, copy, modify, adapt, prepare derivative works of, distribute, store, perform, and display Your Content and any name, username, voice, or likeness provided in connection with Your Content in all media formats and channels now known or later developed anywhere in the world.”

This license also allows Reddit to provide what you post to its affiliates for their use (broadcast, publication etc.) and to remove any metadata associated with what is posted.

As the license includes a waiver of your moral rights, you cannot require attribution for your content or object to derogatory treatment of it.




















What personal data they collect, and what can they do with it?

Reddit’s Privacy Policy can be found here:

Data Reddit collects

Reddit collects your username and password if you choose to create an account, which is optional. If you choose to create an account, Reddit may collect data on your interests, communities you want to join, gender, age or location. These details are, however, all optionally provided and can be removed at later dates.

Content submitted to Reddit (including posts, comments and messages) is collected, as are the actions you take on the platform such as voting, saving and reporting content, and interactions with users and communities.

Your name, address, email address and phone number are collected with reference to any purchases you make on the site.

Your IP address, browser type, operating system, pages visited and device information are among the data collected automatically during your use of the platform. IP addresses are deleted by Reddit 100 days after collection, except the one you used to create an account. Cookie data is also collected by Reddit.

Location data can be shared with Reddit, or Reddit may approximate a location based on your IP address.

Interest or demographic information may be sourced by Reddit from third parties such as advertisers, though these settings can be modified by you upon the platform.

When embedded content (such as a Youtube video or a tweet) from another platform on Reddit, the other platform may collect data relating to this, Reddit does not control how these services collect your data.

Third party service providers are however used by Reddit to measure audiences and collect demographic information through the cookie data you provide.

How Reddit uses your data

Reddit uses the data you provide to:

  • provide, maintain, and improve its services;
  • personalise its services;
  • implement safety measures such as blocking suspected spammers, tackling abuse, and enforcing its user agreement and other policies;
  • optimize, target, and measure the effectiveness of ads shown on our Services;
  • research and develop new services;
  • send technical notices, updates, security alerts, invoices, and other support and administrative messages;
  • provide customer service;
  • send information on products, services, offers, promotions, and events, and provide other news; and
  • monitor and analyse trends, usage, and activities on Reddit.

When your data is shared by Reddit

Reddit will in certain instances share your data with third parties. These instances include but are not limited to:

  • the enforcement of Reddit’s policies or rights;
  • when required by law; and
  • in an emergency.


Who owns what you post?

Linkedin provides a video on who owns the content you post on their site, found here:

For detailed info on ownership of site content, the User Agreement must be consulted:

Section 3.1 provides that:

you own the content and information” posted on LinkedIn.

However, upon signing up you also grant LinkedIn and its affiliates a non-exclusive license allowing them to:

“use, copy, modify, distribute, publish and process, information and content that you provide through our Services and the services of others, without any further consent, notice and/or compensation to you or others.” 

This license can be transferred and sublicensed by LinkedIn, and LinkedIn can edit the content so long as they do not alter its original intended meaning.

This license can be terminated with regard to specific content by deleting that content from the site or by closing your account.

Your consent must be obtained by LinkedIn for usage of your content for additional purposes (such as for use in advertisements by third parties).
















What personal data they collect, and what can they do with it?

LinkedIn’s Privacy Policy can be found here:

Data LinkedIn collects

LinkedIn collects an extensive amount of your data.

Upon registration, it collects your name, email address and/or mobile number. The amount of data collected in the process of profile creation is dependent upon your choices as a user, and this may include your education history, work experience, address book contacts, and location amongst other things.

LinkedIn may also collect data provided by you or others when making posts, sending messages, or when others sync their contacts or calendars with LinkedIn’s services.

LinkedIn also collects data regarding your usage of their affiliates’ services, such as Outlook.

When you use LinkedIn’s services, your usage data is logged. This includes when you click on or simply view content or advertisements, when you search on the site, or apply for jobs. Cookies, log-in data, device information and IP addresses are used in this regard to log your use.

For users located outside of the EU, EEA and Switzerland, LinkedIn can track your device information (including IP address, operating system and browser information) through the use of cookies.

When you go to or from LinkedIn , LinkedIn collect the URL of both the site you came from and the one you go to and the time of your visit, while also collecting data on your network, device and location (if you have opted in to location tracking). Data on when you send, receive or read messages is also collected by LinkedIn .

How your LinkedIn uses your data

LinkedIn uses the data you provide:

  • to personalise its services for increased relevancy to you;
  • to communicate with you about its services;
  • to increase the accuracy of its advertisement targeting;
  • to share with third-party advertisers and ad networks in limited instances (e.g. data that was already visible to users of the site like from your profile);
  • for marketing purposes and to promote membership and network growth;
  • for research and development of both the site’s services and for research on “social, economic and workplace trends, such as jobs availability”. This is sometimes carried out by third parties and can be published as aggregated data;
  • to conduct surveys;
  • for customer support (i.e. dealing with complaints and bugs); and
  • for security purposes.

When your data is shared by LinkedIn

LinkedIn will in certain instances share your data with third parties. These instances include but are not limited to:

  • allowing third parties to carry out maintenance, analysis, audit, fraud detection and development with regard to the site;
  • when required by law, for example in order to investigate or take action against suspected or actual illegal activity or to enforce its agreements; and
  • in the event of a sale, merger or change in control of the company.


Meta (Facebook/ Instagram)

Who owns what you post?

Facebook’s Terms of Service can be found here:

Section 3 provides that: 

“you retain ownership of the intellectual property rights (things such as copyright or trademarks) in any such content that you create and share on Facebook.”  

However, for Facebook/Meta to provide their services they need a license to use this content.

When you share, post or upload content, you grant them a non-exclusive, transferable, sub-licensable, royalty-free and worldwide licence to host, use, distribute, modify, run, copy, publicly perform or display, translate and create derivative works of your content (consistent with your privacy and application settings).

This licence will end when your content is deleted from their systems.

You can delete content that you share, post and upload at any time. All content posted to your personal account will be deleted if you delete your account.

Instagram’s Terms of Use can be found here:

Instagram do not claim ownership of your content but you grant a licence for them to provide the service.  When you share, post or upload content, you hereby grant Instagram a non-exclusive, royalty-free, transferable, sub-licensable, worldwide licence to host, use, distribute, modify, run, copy, publicly perform or display, translate and create derivative works of your content (consistent with your privacy and application settings). This licence will end when your content is deleted from their systems.
















What personal data they collect, and what can they do with it?

Meta’a Privacy Policies for Facebook and Instagram can be found here:

Data Facebook/Instagram collect

To create a personal account, you need to provide your name, email address, phone number and date of birth.

They collect details on your activity including:

  • content that you create;
  • messages you send and receive including their content;
  • types of content you view of interact with;
  • apps you use;
  • purchases or other transactions you make, including credit card information;
  • hashtags you use; and
  • the amount of time you spend on Facebook and Instagram.

This includes how you interact with them and the you interact with most, such as when someone likes your content or sends you a message. If you chose to upload or import your contacts then Facebook and Instagram may suggest connections to make.

They also collect data on your device and its settings (including, but not limited to, its device, IP address and information that has been shared through device settings such as GPS, camera access etc.)

Facebook and Instagram collect and receive information from partners, measurement vendors, and third parties about a variety of your activities on and off their platform. This includes, but is not limited to, apps you use, purchases you make and ads you interact with.

How Facebook/Instagram use your data

Facebook and Instagram use the data you provide:

  • to provide, personalise, and improve their products such as making suggestions for you on groups and events you would be interested in;
  • for ads and other sponsored content using the information about your interests, connections and location (places you like to go) to personalise ads;
  • to provide measurement, analytics, and other business services;
  • to promote safety, integrity and security;
  • to communicate with you; and
  • for researching and innovating for social good.

When your data is shared by Facebook/Instagram

Information with the public is shared such as your user name or your profile if you have a public profile on Facebook/Instagram.

Additionally information is shared in a range of other situations, such as:

  • with people and accounts you share and communicate (when you post with the audience you selected for the post);
  • when you are active on Facebook/Instagram (optional);
  • apps, websites and third party integrations on or using their products; and
  • with third parties such as; partners who use their analytics services; advertisers; measurement partners; partners offering goods and services in their products; vendors and service providers; researchers and academics; law enforcement or legal requests.


Who owns what you post?

Snap Group Limited’sTerms of Service can be found here:

Section 3 provides that once you upload content on Snapchat you retain whatever ownership rights you had to begin with but you grant Snapchat a licence to use that content.  How broad that licence is depends on which services you use and which services you use and settings you have selected.

For all content you submit, you grant Snapchat and their affiliates a worldwide, royalty-free, sub-licensable, and transferable licence to host, store, cache, use, display, reproduce, modify, adapt, edit, publish, analyse, transmit, and distribute that content. This licence is for the purpose of operating, developing, providing, promoting, and improving the services and researching and developing new ones. This licence includes a right for them to make your content available to, and pass these rights along to other service providers with whom they have contractual relationships, solely for the purpose of providing such services.

However, this differs for story submissions being “Public Content” you set as viewable to everyone as well as content you submit to public services, like Public Profiles, Snap Map, or Lens Studio. Because Public Content is inherently public, you grant Snap, their affiliates, other users of the services, and their business partners all of the same rights you grant for non-Public Content, as well as an unrestricted, worldwide, royalty-free, irrevocable, and perpetual right and licence to create derivative works from, promote, exhibit, broadcast, syndicate, reproduce, distribute, synchronise, overlay graphics and auditory effects on, publicly perform, and publicly display all or any portion of your Public Content (including the separate video, image, sound recording, or musical compositions contained therein) in any form and in any and all media or distribution methods, now known or later developed.

When you appear in, create, upload, post, or send Public Content (including your Bitmoji), you also grant Snap, their affiliates, other users of the services, and their business partners an unrestricted, worldwide, royalty-free, and irrevocable right and licence to use the name, likeness, and voice, of anyone featured in your Public Content. This means, among other things, that you will not be entitled to any compensation if your content, videos, photos, sound recordings, musical compositions, name, likeness, or voice are used by them, their affiliates, users of the services, or their business partners.


 What personal data they collect, and what can they do with it?

Snap Group Limited’s Privacy Policy can be found here:

What do they collect?

To create a personal account you need to provide your name, username, password, email address, phone number and date of birth. Other information such as a profile picture or bitmoji can be optionally provided.

Snap collects data on:

  • usage information (how you interact with their services and how you communicate with other Snapchatters);
  • content information (the metadata that is provided with the content);
  • device information;
  • your device’s phone book (with permission, data is collected on your contacts);
  • camera, photos and audio (most Snap services require Snap to collect images and other information from your device’s camera and photos);
  • location information (with permission);

Additionally snapchat collects information about you from other users, their affiliates and third parties.

How Snap uses your data 

Snapchat uses your information to:

  • develop, operate, improve, deliver, maintain and protect their products and services;
  • send communications;
  • monitor and analyse trends and usage;
  • personalise their services;
  • add context (tagging memories, content of photo – for example, if there is a dog in the content, the content will be searchable by dog);
  • provide and improve their advertising;
  • enhance the safety and security of products and services;
  • verification of identity;
  • to enhance their services and experience with them;
  • enforce, investigate and report conduct violating their Terms of Services and other usage policies, respond to requests from law enforcement and comply with legal requirements.

When your data is shared by Snap

  • Information about you that is shared with other Snapchatters includes; your username, name and Bitmoji; how you interact with snapchat (your Snapchat Score, location history if location sharing is on etc.); information about your device; any information that you have directed them to share; content that you post or send;
  • Information about you that is shared with all Snapchatters, their business partners and the public includes; public information (public profile etc.), public content (highlights, story submissions that are set to be viewable by everyone etc.);
  • With Snapchats affiliates;
  • With third parties; to service providers; to business partners that provide services and functionality on their services; to prevent fraud; for legal, safety and security reasons; as part of a merger or acquisition;
  • Non-personal de-identified information will also be shared with third parties that provide services to use or preform businesses purposes for them.

Snapchat may also share information for legal, safety and security reason.













Who owns what you post?

TikTok’s Terms of Service can be found here:

TikTok do not own your content. If you are the owner of the intellectual property rights in the content that you make available on the platform, then nothing in the terms changes that.

To provide the platform, TikTok requires a licence from you. By creating, posting or otherwise making content available on the platform, you grant TikTok a non–exclusive, royalty free, transferable, sublicensable, worldwide licence to use your content, including to reproduce, adapt of make derivative works (e.g. to display it) for the purposes of operating, developing and providing the platform, subject to your platform settings.

This licence granted to TikTok also extends to affiliates as part of making the platform available.

Your licences to TikTok and to users end when you close your account or when you or TikTok remove your content from the platform. However, due to the nature of the platform and their legal obligations, the licence granted will continue after you have removed your content to the extent that:

  • you have allowed, via your platform settings, other users of the platform to use or reuse your content; or
  • TikTok are obliged to store or process your content for legal reasons.


















What personal data they collect, and what can they do with it?

TikTok’s Privacy Policy can be found here:

Data TikTok collect

  • Information you provide such as; profile information (date of birth, username, email address etc.); user content (what you create and publish); direct messages; your contacts; purchase information; surveys, research, promotions; information when you contact them.
  • Automatically collected information such as; technical information; location information; usage information; content characteristics and features; inferred information; cookies.
  • Information from other sources such as; advertising, measurement and data partners; third party platforms and partners; others (they may receive information about you from others when you are mentioned in a compliant etc.).

How TikTok uses your data

Tiktok uses your information to:

  • provide and administer the platform;
  • personalise and customise your experience on the platform such as providing your “For You” feed;
  • process, facilitate, or fulfil requests of purchases of products, goods, and services;
  • enforce terms, guidelines and other policies that apply to you;
  • provide certain interactive features, such as enabling your content to be used in other users’ videos and to suggest your account to other users to help connect you with other users;
  • provide and improve advertising services, including to serve adds (including personalised ads where permitted) and to measure and understand the effectiveness of the ads and other content;
  • maintain and enhance the safety, security and stability of the Platform by identifying and addressing technical or security issues or problems (such as technical bugs, spam accounts and detecting abuse, fraud and illegal activity);
  • review, improve and develop the platform including the monitoring interactions and usage across your devices, analysing how people are using it, and by training and improving their technology such as their learning models and algorithms;
  • share your information with third party platforms to provide you with features, like content sharing at your request when you integrate your TikTok account with a third party service;
  • promote the platform or third party services through marketing communications, contests or promotions; and
  • comply with their legal obligations, or as necessary to perform tasks in the public interest, or to protect the vital interests of our users and other people.

When your data is shared by TikTok

TikTok shares your information with:

  • service providers that help them provide, support and develop the platform and understand how it is used;
  • partners such as; third party platforms and partners, advertisers, measurement and data partners;
  • their corporate group;
  • other users and the public (based on your privacy settings); and
  • users of their analytics services.


Given the degree of media attention to social media platforms’ use of user data in recent years, data regulation is of course a hot topic for legislators, with multiple recent developments and likely upcoming changes.

United Kingdom

As part of the UK’s National Data Strategy, the UK Government has sought to install a trusted data regime that is conducive to economic growth and innovation, first and foremost by means of its proposed Data Reform Bill, expected to be passed into law at some point in 2023. The bill proposes to free up the use of data by, amongst other things, limiting the scope of “personal data”; amending the ability to use personal data for “legitimate interests” in the interests of scientific research and the public sector; and easing the requirements for the use of cookies online.

While the intended goal of this proposed legislation is to deliver on the aims of the National Data Strategy and make life easier for smaller businesses by removing red tape, critics have argued that it will do the opposite, effectively forcing companies doing business both in the UK and EU to operate under two separate data regimes. Proponents of the bill, such as the former Minister for Media, Data and Digital Infrastructure Matt Warman, have claimed that the more likely practical result will be the maintenance of a free flow of personal data from the EU and will enable partnerships on a worldwide scale.

European Union

The long-running controversy regarding the security of user data on TikTok – which has included calls from the US to ban the app – has recently been addressed by the European Commission, with European Commission Vice President calling on the Chinese social media giant to respect the laws of the EU and maintain the safety of European users’ data.

These comments coincided with a meeting between Tiktok’s CEO, Shou Zi Chew, and the European Commission in Brussels, and they come after the launch of two investigations by the Irish data protection regulator, one into potentially unlawful transfers of European user data to China and the other on children’s privacy.

United States

2022 saw the introduction of a more robust data protection regime in the US by means of a presidential executive order, which seeks to create a framework providing sufficient safeguards for personal data in line with the ECJ’s decision in Schrems II. Included are mechanisms created to limit surveillance agencies’ access to data as well as a tiered redress mechanism to handle complaints. Decisions will be made in the coming months by the UK and EU on the adequacy of this new regime, which will hopefully allow for the free movement of personal data between the US and the UK and EU.


Last year, China introduced a host of new data export regulations which have been highlighted as potential barriers for cross-border data flow for legitimate business operations. The most problematic areas of the rules include a requirement for overseas “core” data transfers to go through a security review process before receiving the required permissions and a requirement for companies who are qualified to transfer data across borders to record their “Standard Contractual Clauses and their privacy impact assessment report” with regulators before transferring data out of China. Commentators have claimed that such rules may jeopardise China’s position at the forefront of digital trade and manufacturing.


Glasgow Edinburgh Inverness Elgin Thurso Shetland
Get in touch

Call us for free on 0330 912 0294 or complete our online form below for legal advice or to arrange a call back.

Speak to us today on 0330 159 5555

Get in touch


Get in touch

Call us for free on 0330 159 5555 or complete our online form below to submit your enquiry or arrange a call back.