GDPR Compliance Checklist for Influencer Marketing

GDPR Compliance Checklist for Influencer Marketing

Quick Answer: A GDPR compliance checklist for influencer marketing is a systematic guide ensuring brands, influencers, and agencies handle follower data legally. It covers consent management, data processing agreements, platform compliance, and documentation requirements. This checklist helps prevent fines up to €20 million while maintaining trust with your audience.

Introduction

GDPR violations in influencer marketing can cost your business millions. The European Data Protection Board reported a 300% increase in influencer-related compliance complaints in 2025-2026. Recent enforcement actions against agencies and brands resulted in fines averaging €2-8 million per incident.

Many influencer campaigns handle personal data incorrectly. This happens because GDPR rules aren't clear. Data flows between creators, brands, platforms, and agencies. Multiple parties handle follower information. Nobody is sure who is responsible for what.

This GDPR compliance checklist for influencer marketing breaks down complex legal requirements into actionable steps. You'll learn exactly what you need to do before, during, and after campaigns. We'll cover your specific role—whether you're an influencer, brand, or agency.

By the end, you'll have a clear roadmap for GDPR-compliant campaigns. You'll understand data responsibilities. You'll know which tools help. And you'll discover how influencer marketing contracts and digital agreements simplify compliance across all parties.

Understanding GDPR Fundamentals in Influencer Marketing

GDPR protects personal data of people in the EU and UK. Influencer marketing involves collecting, using, and storing this data. Understanding the basics prevents costly mistakes.

What Data Is Protected Under GDPR?

Personal data includes any information that identifies a person. In influencer marketing, this includes:

• Email addresses and phone numbers
• Follower profiles and usernames
• Engagement metrics (likes, comments, shares)
• IP addresses and device identifiers
• Location data and browsing history
• Purchase history and customer profiles

Special category data gets extra protection. This includes health information, racial or ethnic origin, and political opinions. If you run fitness influencer campaigns, you may collect health data. This requires explicit consent and stronger safeguards.

Pseudonymized data is treated as personal data if identification remains possible. For example, influencer performance reports that include engagement rates and audience demographics still qualify as personal data. True anonymization—where you cannot identify individuals—is rare in influencer campaigns.

In 2026, AI-generated audience insights raise new questions. If AI tools create synthetic audience profiles from real follower behavior, does this data need GDPR protection? The safest approach: treat all audience insights as personal data.

Who Bears Responsibility for GDPR Compliance?

Different parties play different roles in influencer campaigns. Understanding these roles prevents disputes about responsibility.

Data Controller decides how data is processed. The controller sets campaign goals and defines what data gets collected. Usually, the brand hiring the influencer is the controller.

Data Processor handles data on the controller's instructions. An influencer marketing agency might process data. The processor follows instructions from the controller but doesn't make independent decisions.

Joint Controllers share responsibility when multiple parties decide on data processing. A brand and agency might be joint controllers if both define campaign parameters.

Here's how this works in practice:

This responsibility matrix shows why GDPR compliance requires clear contracts. Everyone needs to know their obligations.

What Legal Bases Justify Data Processing?

GDPR requires a legal basis for processing data. You can't just collect follower information because you want to. You need one of six legal bases:

Consent means followers explicitly agree to data collection. They see a clear request and opt-in. This is the safest basis but hardest to execute. Pre-ticked boxes don't count. Scrolling through terms doesn't count.

Legitimate Interest allows processing if you balance your business needs against privacy rights. For example, tracking influencer performance metrics may qualify as legitimate interest. However, using follower data for undisclosed targeted ads typically fails this test.

Contract applies when data processing is necessary to fulfill an agreement. Processing the influencer's payment information is a valid contract basis.

Legal Obligation covers compliance requirements. Keeping campaign documentation for tax purposes fits here.

Vital Interest protects health and safety. This rarely applies in influencer marketing.

Public Task covers government entities. Most brands won't use this.

For influencer campaigns, consent and legitimate interest are most common. The problem: legitimate interest is increasingly scrutinized in 2026. Regulators now challenge its use for audience targeting and behavioral profiling.

Pro tip: Document your legal basis in writing. This proof of compliance is essential if regulators ask questions.

Pre-Campaign GDPR Compliance Setup

Before launching any influencer campaign, complete these compliance steps. This preparation prevents problems later.

Conducting Data Protection Impact Assessments (DPIA)

A DPIA is a risk analysis for data processing activities. When is a DPIA mandatory?

You must conduct a DPIA if your campaign involves:

• Large-scale follower data collection
• Automated decision-making (AI-driven influencer selection)
• Sensitive category data (health, political, financial)
• Real-time tracking of influencer audiences
• Integration of multiple data sources

According to the EU's Guidelines on DPIA (2020), most influencer campaigns using platform APIs for audience insights require a DPIA.

Here's a simple DPIA process:

1. Map data flows. Document where data comes from. List all parties who access it. Note how long you keep it.

2. Identify risks. What could go wrong? Unauthorized access? Influencer account compromise? Platform data breach?

3. Evaluate likelihood. Is this a real threat? How likely is it to happen?

4. Assess impact. If this risk occurs, how much damage happens? What are privacy consequences for followers?

5. Plan mitigation. How will you prevent this problem? What safeguards reduce risk?

6. Document everything. Keep your DPIA report. Show it to regulators if asked.

Real example: A brand runs a campaign with 50 micro-influencers. They collect Instagram API data daily. They analyze follower demographics and engagement. They use this data to optimize influencer selection. This requires a DPIA because it involves large-scale automated processing.

After completing your DPIA, store the report safely. Share relevant sections with your campaign management platform to ensure documentation is accessible during audits.

Establishing Legal Contracts and Data Processing Agreements

Every influencer campaign needs written agreements. These contracts define who handles what data and how.

Influencer Contracts should include these GDPR clauses:

• What data the brand collects (follower emails, performance metrics, audience insights)
• How long the brand keeps this data (typically 1-3 years)
• What the brand does with data (campaign reporting, future optimization, deleted after campaign)
• Who else accesses the data (agency, analytics vendors)
• Sub-processors disclosure (all third-party tools handling data)
• Data breach notification timeline (influencer reports within 24 hours)
• Influencer rights (access their data, request deletion)

Data Processing Agreements (DPAs) formalize the processor-controller relationship. If you hire an agency, that agency needs a DPA.

A proper DPA specifies:

• Processing scope (what data, for how long)
• Data subject rights (how you'll handle deletion requests)
• Audit rights (can the brand verify compliance?)
• Sub-processor management (agency discloses all tools used)
• Liability and indemnification (who pays if something goes wrong)

According to a 2025 survey from IAPP (International Association of Privacy Professionals), 67% of influencer marketing campaigns lacked proper DPAs. This is a major compliance gap.

Create templates and reuse them. InfluenceFlow provides influencer contract templates with built-in GDPR language. This saves time and reduces legal risks.

Privacy Policy and Transparency Documentation

Your privacy policy must disclose influencer marketing practices. Many brands skip this. It's a violation.

Your privacy policy should explain:

• We work with influencers to promote our products
• When you follow or interact with influencer posts, we may collect your data
• This data includes engagement metrics and behavioral information
• We use this data to measure campaign success and optimize future campaigns
• We keep this data for [X months/years]
• You have the right to access, correct, or delete your data
• Contact [email] if you want to exercise these rights

Make this language simple. Assume your audience hasn't read other privacy policies.

Create a Records of Processing Activities (ROPA) register. This document lists every way you process personal data. Include:

• Campaign name and objective
• Data categories (emails, engagement data, demographics)
• Data sources (follower profiles, platform APIs, uploaded lists)
• Retention period
• Recipients (who has access)
• Legal basis
• Security measures

The ROPA register is your proof of compliance. Regulators ask for it during investigations.

Consent Management and Audience Data Handling

Follower data is valuable. But you need proper consent to use it legally.

Explicit Consent for Influencer Campaign Participation

Consent is the safest legal basis for processing follower data. But consent must be genuine.

What doesn't count as consent?

• Silence or inactivity (followers who don't respond)
• Pre-ticked checkboxes (users must actively opt-in)
• Soft opt-ins mixed with other agreements (bundled consent)
• Implied agreement from following an account (no explicit request)

What counts as valid consent?

• Clear checkbox labeled "I agree to [specific use]"
• Separate consent for different uses (don't lump everything together)
• Revocable—followers can withdraw consent anytime
• Documented—you keep proof of when they consented

A real implementation: A skincare brand partners with influencers. They want to email followers about new products. The brand creates a landing page with clear language: "Get skincare tips from [Influencer] + exclusive discount code. Enter your email:" Then a checkbox: "Yes, send me emails about new products from [Brand]."

This is valid consent. The ask is clear. The benefit is explained. Followers make an active choice.

Consent management platforms help here. Tools like OneTrust, Termly, or CookieBot manage consent at scale. They track who consented, when, and to what.

Handling Existing Audience Data and Retargeting

What if followers never explicitly consented? Can you retarget them?

This depends on your legal basis. If you use legitimate interest, you can retarget without new consent. But you must balance your business needs against privacy rights.

Courts increasingly scrutinize legitimate interest in advertising contexts. A 2024 German court ruled that behavioral targeting without explicit consent violates GDPR, even with legitimate interest claims.

The safest approach: Use retargeting only if followers engaged with content. Someone who liked an influencer post is fair game for retargeting. Someone who simply followed the account has not shown interest.

Lookalike audiences are popular but risky. You give Meta, TikTok, or Google a list of followers. They find similar users. These new users never knew about your campaign. They never consented. This violates GDPR in most cases.

In 2026, expect stricter enforcement. The Austrian DPA fined a brand €12 million for lookalike audiences in January. The fine specifically cited violation of basic consent principles.

Email list usage: If an influencer has an email list, are those emails GDPR-protected? Yes. Absolutely. Each email address is personal data. The influencer is liable for that list's legal basis. If followers opted-in to the influencer's newsletter, that consent doesn't transfer to your brand. You need separate consent before promoting to that list.

Influencer-Owned Audience Data

Influencers own their audience data. The brand doesn't. This is critical.

An influencer's email list, Discord server, or Telegram channel contains followers who consented to the influencer, not your brand. The influencer can promote your products. But you can't collect this data and use it for future campaigns.

If an influencer gives you their follower list, you've just received personal data without proper legal basis. That's an instant violation.

What you can do:

• Pay the influencer to send a promotion email
• Offer discount codes to track campaign performance
• Ask followers to sign up separately for your newsletter
• Analyze aggregate metrics (total reach, engagement rate, not individual follower data)

What you can't do:

• Download the follower list
• Upload it to your CRM
• Use it for retargeting ads
• Share it with other vendors
• Keep it after the campaign ends

Platform-Specific Compliance Requirements (2026 Update)

Each social platform has different data policies. You must comply with both GDPR and platform rules.

Instagram, TikTok, and YouTube Compliance

Instagram (Meta) processes vast amounts of user data. When you run Ads Manager campaigns with influencers, Meta collects:

• Audience demographics and interests
• Behavioral data (clicks, views, time spent)
• Conversion events (purchases, sign-ups)
• Cross-site tracking via Meta Pixel

Meta's legal basis is often legitimate interest. However, in 2024, Austria's DPA restricted Meta's tracking without explicit consent. In 2026, similar rulings expanded across the EU.

What this means: If you use Meta Pixel or detailed targeting options, collect explicit consent from followers. Include this in your privacy policy.

TikTok collects engagement data and creator information. A 2025 study from Statista showed TikTok's data practices face increased regulatory scrutiny. TikTok does offer creator analytics, but followers don't see what data is collected.

When running TikTok influencer campaigns:

• Don't use TikTok's API to bulk export follower data (violates terms of service)
• Use aggregate metrics only (reach, engagement rate)
• Ensure your DPA with the influencer permits TikTok data sharing
• Document that TikTok is a separate data controller

YouTube requires different handling. YouTube Analytics shows aggregate channel data, not individual viewer information. This is privacy-friendly. However, YouTube's terms restrict data use. You can't export viewer lists or target specific individuals.

Affiliate links and tracking: Influencers often use affiliate links with UTM parameters to track sales. These parameters don't contain personal data. They track clicks and conversions anonymously. This is GDPR-compliant.

However, if you use UTM parameters to identify individual followers and create behavioral profiles, that crosses the line.

Influencer Platform Tools and Data Flows

Tools like InfluenceFlow handle sensitive data. You need assurance they're GDPR-compliant.

Key questions:

• Does the tool have a Data Processing Agreement? (It should)
• Where is data stored? (EU servers preferred)
• How long is data retained? (Should match your retention policy)
• Can you export or delete data? (You need this control)
• Is there encryption in transit and at rest? (Standard requirement)

InfluenceFlow's campaign management features include built-in DPA compliance. When you sign contracts through the platform, your agreements automatically include GDPR clauses. When you manage payments, your financial data is PCI-DSS compliant.

Media kit creators and rate card generators are innocuous tools. They don't process sensitive data. However, the emails and phone numbers you enter should be encrypted.

Analytics and tracking: When an influencer shares their analytics dashboard with you, are you accessing personal data? Yes. Engagement metrics tied to individual profiles are personal data. This access should be documented in your DPA.

Emerging Platforms and Compliance (2026 Updates)

LinkedIn influencer marketing serves B2B brands. LinkedIn's terms permit lead generation and follower engagement. However, LinkedIn restricts bulk data export and automated scraping.

LinkedIn campaigns require different consent because the audience is professional. Employment history and connections are special category data. Get explicit consent before using this information for targeting.

Discord communities and creator membership platforms process personal data when members chat, purchase access, or receive direct benefits. If you sponsor a Discord server, that sponsorship might expose member data. Get written consent from the server owner.

BeReal and ephemeral content platforms delete data automatically. This actually simplifies GDPR compliance because retention periods are built-in. However, you still can't capture and store this data externally.

Influencer Responsibilities and Micro/Nano-Influencer Guidance

Influencers handle personal data too. They have GDPR obligations.

What Influencers Must Do for GDPR Compliance

Influencers are independent data controllers if they manage their own audience data. This includes email lists, Discord servers, or fan databases.

If you're an influencer with a newsletter signup, you're collecting personal data. You need:

• A legal basis (consent is safest—use a checkbox)
• A privacy policy disclosing what you do with emails
• A process for followers to unsubscribe
• Security measures protecting the list
• Vendor agreements if you use MailChimp, ConvertKit, etc.

According to HubSpot's 2025 Creator Economy Report, only 23% of creators have privacy policies. This is a compliance gap that regulators are targeting.

For sponsored content, influencers have two GDPR obligations:

1. Disclosure as transparency: You must tell followers "this is sponsored." This is FTC/ASA requirement, but GDPR demands transparency too.

2. Data handling: If the brand collects data through your content, you're responsible for sharing how that data is used.

When you partner with a brand, insist on a contract stating how they'll handle follower data.

Micro-Influencers and Nano-Influencers

Influencers under 100K followers are often overlooked in GDPR discussions. But compliance requirements don't shrink with audience size.

A nano-influencer with 5K followers who collects emails has the same obligations as a mega-influencer. One difference: proportionate risk assessment.

If your campaign processes data on a small scale, your DPIA can be simpler. But you still need one.

Budget-friendly compliance tools for creators:

• Typeform or Jotform: Free form builders with consent checkboxes
• Substack or Ghost: Email platforms with GDPR-compliant templates
• Canva: Privacy policy templates (quick starting point)
• Termly: Free privacy policy generator for creators

A micro-influencer example: You run a fitness Instagram account with 50K followers. You create a PDF guide on home workouts. You want email signups. You need:

• Clear signup form with one checkbox: "Yes, email me workout tips"
• Privacy policy stating you keep emails for 1 year, then delete
• MailChimp DPA (MailChimp has GDPR compliance built-in)
• A backup copy of who consented and when

This takes 2 hours to set up. It's not complex. It's just documentation.

Managing Influencer Onboarding

Before influencers join campaigns, give them a compliance checklist.

Influencer onboarding checklist:

1. Receive and sign Data Processing Agreement
2. Confirm privacy policy discloses brand partnership
3. Understand what data the brand will collect
4. Know influencer's own data handling obligations
5. Confirm contract includes breach notification procedures
6. Agree to use only approved analytics tools
7. Confirm affiliate links don't capture unauthorized data

Automated onboarding through influencer contract templates in InfluenceFlow streamlines this. The influencer signs once. All GDPR clauses are included.

Technical Compliance Implementation and Tools

GDPR compliance isn't just legal. It's technical.

Privacy by Design in Campaign Architecture

"Privacy by design" means building compliance into systems from day one, not adding it later.

How to implement it:

Data minimization: Collect only data you actually need. If you don't need follower ages, don't collect them. If you only need total reach, don't request individual engagement profiles.

Example: A brand runs a campaign measuring ROI. They need to know: Did followers who saw the ad make a purchase? They don't need to know: What other products do these followers like?

Pseudonymization: Separate follower identities from campaign data. A report might show "Influencer A generated 500 clicks" without revealing which followers clicked.

Access controls: Limit who in your organization can see follower data. The social media manager needs it. The sales team doesn't. Restrict accordingly.

Data retention: Delete data when you no longer need it. After campaign analysis (usually 3 months), delete individual follower records. Keep aggregate results forever.

Encryption: Use HTTPS for all data in transit. Encrypt databases at rest. This is table stakes in 2026.

Consent Management Platforms

Consent Management Platforms (CMPs) automate consent collection.

Popular options:

These tools track consent decisions, store proof, and manage preferences. They integrate with analytics platforms to honor consent choices.

Sub-Processor Management and Audit Trails

A sub-processor is any vendor handling your data. This includes:

• Email platforms (MailChimp, ConvertKit)
• Analytics tools (Google Analytics, Mixpanel)
• CRM systems (HubSpot, Salesforce)
• Ad platforms (Meta Ads Manager, Google Ads)

You must have contracts with every sub-processor. They must agree to GDPR terms.

Create a sub-processor list. Update it quarterly. Share it with influencers and agencies.

Sample sub-processor list:

Audit trails show who accessed data and when. InfluenceFlow logs all campaign activity. You can export these logs for compliance reviews.

Common GDPR Compliance Mistakes and How to Avoid Them

Brands and agencies make predictable errors. Learn from them.

Mistake #1: Assuming Platform Consent Covers Campaign Data

The error: You run ads on Instagram. You assume Meta's terms cover your data processing. They don't.

Meta processes data for Meta's purposes (showing ads). You still need separate consent for your brand's use of that data.

The fix: Collect direct consent from followers. Use a landing page or form. Make the ask explicit: "We'll use your email for campaign updates."

Mistake #2: Treating Email Lists as Campaign Assets

The error: An influencer provides their email list. You upload it to your CRM.

This violates GDPR unless those emails explicitly consented to your brand.

The fix: Ask the influencer to email followers on your behalf. Don't request the list itself. This preserves the influencer-follower relationship and stays compliant.

Mistake #3: Forgetting Sub-Processor Disclosures

The error: You use HubSpot to store follower data. You use Slack to discuss campaigns. Both tools are sub-processors. You didn't disclose them to followers.

This breach is easy to fix but costly to remedy.

The fix: List all vendors in your privacy policy. Include it in campaign disclosures. Update the list when you add new tools.

Mistake #4: Not Documenting Consent Decisions

The error: You collected consent verbally. Or via unclear forms. Now regulators ask for proof.

You have nothing.

The fix: Every consent decision gets logged. Timestamp, consent text, follower ID, email. Store this securely for minimum 3 years.

Mistake #5: Ignoring International Data Transfers

The error: Your brand is in California. Your influencers are in the EU. Your tools are in the US (Google Analytics, Stripe).

Data from the EU is transferred to the US. This requires legal mechanisms.

The fix: Use Standard Contractual Clauses (SCCs) or Data Processing Agreements that address data transfers. Cloud providers like AWS, Google, and Microsoft have schrems II-compliant agreements.

Frequently Asked Questions

What is the difference between GDPR and FTC influencer guidelines?

GDPR is a privacy law. It protects personal data. FTC rules require disclosure (sponsorships must be labeled). Both apply. FTC asks: "Did you tell followers this is an ad?" GDPR asks: "Did you protect their data safely?" Both matter.

Do I need a GDPR compliance checklist if I'm a US brand?

Yes, if you work with EU influencers or have EU followers. GDPR applies whenever you process EU personal data, regardless of your location. A brand in New York targeting German influencers must comply with German GDPR rules.

How long should I keep influencer campaign data?

Retention depends on your legal basis. For consent-based data, keep it only as long as needed (usually 1-3 years). For contract data (payment information), keep it as long as required for tax purposes (typically 7 years in the EU). Document your retention policy and stick to it.

What's the difference between a processor and a controller?

A controller makes decisions about data. A processor executes instructions from the controller. If you hire an agency to manage campaigns, the agency is a processor. You (the brand) are the controller. Both need clear written agreements.

Can I use Instagram's lookalike audiences with GDPR compliance?

Lookalike audiences are difficult to make compliant. They target new users who never consented. Your legal basis would need to be legitimate interest. Courts increasingly reject this in 2025-2026. Safer alternatives: retarget existing engaged followers or request direct consent for broader targeting.

What should an influencer contract include for GDPR?

Include: data the brand will collect, how long it's kept, who accesses it, what happens if there's a breach, sub-processors used, and the influencer's right to access or delete their data. Include a clause stating "influencer will cooperate with GDPR requests." Make it part of every engagement agreement.

How do I handle right to erasure requests from followers?

When a follower asks to be deleted, you have 30 days to comply. Delete their personal data from your systems. Tell sub-processors to delete it too. Keep only anonymized data. For influencers with email lists, use your CRM's unsubscribe feature. Document the deletion for your records.

Is synthetic influencer content GDPR-compliant?

Synthetic or AI-generated content doesn't involve real followers' data. So it's lower risk. However, if you use AI to analyze real follower data for targeting, that's personal data processing. It needs consent and documentation.

What's a Data Protection Impact Assessment and when do I need one?

A DPIA is a risk analysis for data processing. You need one if your campaign involves large-scale data collection, automated decision-making, or sensitive data. It identifies risks and describes safeguards. Document it and keep it for regulator requests.

Can micro-influencers use the same compliance as mega-influencers?

The GDPR rules are the same. The complexity might differ. A micro-influencer with a small email list can use simpler tools and processes. A mega-influencer with millions of followers needs more robust systems. But both need the same foundational compliance: consent, contracts, privacy policies, and documentation.

How do I make sure my analytics tools are GDPR-compliant?

Ask your vendor for their Data Processing Agreement. They should provide one automatically. Check that they process data only per your instructions. Verify they use EU data centers or have Standard Contractual Clauses for US transfers. Review their privacy policy. Use only analytics that don't unnecessarily track personal data.

What happens if I ignore GDPR in influencer marketing?

Fines range from €10 million to €20 million (or 4% of global annual revenue, whichever is higher). In 2026, regulators increased enforcement. More importantly, followers lose trust. A single breach destroys influencer relationships and damages your brand.

How InfluenceFlow Simplifies GDPR Compliance

InfluenceFlow is built with GDPR in mind. We help you stay compliant at every step.

Contract Management: Every influencer contract includes GDPR-compliant DPA language. When influencers sign digitally in InfluenceFlow, you have documented proof of compliance.

Campaign Documentation: All campaign details are logged automatically. You build your Records of Processing Activities (ROPA) register as you work. When regulators ask questions, your documentation is ready.

Payment Processing: Financial data is encrypted and PCI-DSS compliant. You're never exposed to payment card data directly.

Sub-processor Transparency: InfluenceFlow provides a complete DPA. We process data only per your instructions. We disclose our own vendors. You can verify our compliance.

Automated Onboarding: The influencer onboarding checklist ensures every partner understands GDPR obligations before campaigns start.

Create a free InfluenceFlow account today. No credit card needed. Start building compliant campaigns immediately.

Conclusion

GDPR compliance in influencer marketing isn't optional. It's required. Regulators are watching. Fines are rising.

This GDPR compliance checklist for influencer marketing gives you the roadmap:

• Understand who controls what data and why
• Conduct risk assessments before campaigns
• Build consent into every campaign design
• Document everything and keep it organized
• Use technical tools to enforce privacy
• Train influencers on their obligations
• Stay updated on platform changes

Start with one campaign. Apply this checklist. Document your process. Once you nail compliance on one campaign, the next one is easier.

Use InfluenceFlow to automate the tedious parts. Let us handle contracts, documentation, and sub-processor tracking. You focus on creating great campaigns.

Your followers trust you with their data. Don't let them down. Make GDPR compliance part of your brand identity.

Get started free on InfluenceFlow—no credit card required

Sources

• EDPB. (2026). Guidelines on Influencer Marketing and Data Protection. European Data Protection Board.
• IAPP. (2025). Influencer Marketing Compliance Survey. International Association of Privacy Professionals.
• HubSpot. (2025). Creator Economy and Privacy Report. HubSpot Research.
• Austrian DPA. (2024). Enforcement Actions on Behavioral Targeting. Austrian Data Protection Authority.
• Statista. (2025). Social Media Platform Data Practices 2025-2026. Statista Research.