Social media monitoring privacy and platform rules

Short answer

A public post is not free to use for any purpose. A social media monitoring programme is subject to three sets of rules: personal data law (purpose, volume, retention, special categories), platforms' terms of use (how data may be collected), and sites' technical rules (robots.txt, request limits). The practical approach: state the purpose in writing, collect only what is about the brand, do not build profiles of people, do not keep sensitive data, set a retention period, and do not use a method a platform's terms do not allow. This article is not legal advice.

Why "public" does not mean "permitted"

The most widespread misconception is "if anyone can see it, I can use it". But a post being visible does not settle for what purpose, by what method and for how long it may be collected and kept. Someone wrote their complaint on a forum — they may expect the company to reply, but they do not expect all their posts to be collected and turned into a profile. Laws and platform terms regulate exactly that difference.

What Azerbaijani law says

• Open and confidential data — the open category includes information the data subject made public themselves (Article 5.3), but on request the operator must prove the data belongs to the open category (8.5).
• Purpose — the purpose of collection must be stated precisely in advance, and data processed only for that purpose (9.1).
• Volume — the amount and nature of data collected must fit the stated purpose (9.2).
• Retention — once the purpose is achieved and there is no need to keep it, the data must be destroyed (9.4).
• Special categories — data on racial or national origin, family life, religious belief, health and criminal record (2.1.6) may be processed only in the limited cases the law sets out (9.7).

In the European Union, similar special categories are in Article 9 of the GDPR; there is a separate exception there for data the subject has manifestly made public (9(2)(e)), but it does not cancel the other requirements — purpose, volume, retention.

Platform terms

Every platform has its own terms of use, and they often restrict automated collection. Meta's Automated Data Collection Terms, for example, accept automated collection from Facebook and Instagram only with Meta's separate written permission, and stress that accepting the terms is not itself that permission. Meta's Content Library for researchers is for non-profit research organisations, not brand monitoring. So for monitoring, ask of each source: does this platform have an official API or a permitted route, and does our method comply with its terms?

Websites and robots.txt

For news portals, forums and blogs, good practice is to follow the site's robots.txt rules, limit the number of requests and identify yourself with a clear user agent. But the RFC 9309 standard itself says robots.txt rules are not a form of access authorization — so following them does not replace the site's terms of use or copyright. Keeping an article's full text in your system, republishing it or turning it into a commercial product are separate questions.

A seven-point programme checklist

1. 1PurposeIn writing: for example, "to reply to public reviews of the brand and improve service". Profiling, hiring or individual assessment are not purposes.
2. 2SourcesWhich public sources, by which method; no closed groups, private messages or fake accounts.
3. 3MinimisationOnly posts about the brand; no extra information collected about authors.
4. 4Special categories and childrenHealth, religion, family and similar data are not copied into analysis tables; children's data needs particular care.
5. 5RetentionHow long data is kept and when it is deleted — a written period.
6. 6AccessWho can see it; where exported files are stored.
7. 7ContractorsThe same rules in the contract with an agency or tool supplier.

Deletion and objection requests

A person may ask for their post to be removed from your system, or for data about them not to be processed. Have a process ready in advance: who receives the request, how fast it is answered, and from which systems it is deleted — the monitoring tool, exported files, reports. Agree the law's specific deadlines and conditions with your legal team. Ignoring such a request is both a legal and a reputational risk.

Privacy in reports

• Give quotes anonymously in internal reports; names and profiles only when needed to reply.
• Blur other people's names and photos in screenshots.
• Remove personal data before sharing a report with an agency.
• Do not keep raw-result exports in shared folders.

Illustrative example

This is an illustrative example. A clinic sets up a monitoring programme. The purpose is written down: "to reply to public reviews of the clinic and find service problems". A special rule: if a post contains information about a patient's diagnosis or treatment, it is not copied into the analysis table, and the reply is general and invites the person to a private channel — medical details are not discussed in public. Retention is set at six months, and exports are kept only in the quality department's folder.

Limitations

This article is a general framework and not legal advice. Laws, their interpretation and platform terms change; check the current texts and a lawyer's view for a specific source, country and use. No tool ensures legal compliance automatically — it depends on your purpose, process and decisions.

Common mistakes

• "If it's public, it's permitted" thinking.
• Not stating the purpose in writing.
• Building profiles of authors.
• Keeping everything with no retention period.
• Using a collection method a platform's terms do not allow.

Competitors and your own data

Ethical limits specific to competitor monitoring are in ethical competitor monitoring. Privacy in a company's own calls and chats follows different rules — covered in privacy in conversation analytics.

Boundaries in Vexvon Monitoring

In Vexvon Monitoring you choose which sites are monitored — there is no hidden source and no automatic site discovery. When sites are crawled, robots.txt rules are followed in line with RFC 9309, and there is a request limit per domain. The AI reads posts as being about the brand and does not build a separate profile of the author. Purpose, retention period and permitted sources are set by your own policy. The platform's security commitments are on the security page; for the product, see Vexvon Monitoring.

Next step

This month, write the first version of the seven-point document and agree it with your legal team. At least three questions should be clear: what the purpose is, which sources are permitted and when data is deleted. Other topics are in the monitoring queries, data and reliability section; if you have questions, get in touch.