Every comparison table in the social data market leaves out the same line, and it is the one that transfers legal responsibility onto you.
This is written for builders, not lawyers. I am not one, this is not legal advice, and if you are operating at scale or in a regulated sector you should pay someone who does this properly. What follows is the shape of the problem, which is the part most people are missing entirely.
The sentence that surprises people
Public data is still personal data.
Nothing about a page being open to the world removes it from the scope of GDPR or LGPD. Both define personal data as information relating to an identifiable person. A follower count attached to a handle attached to a human being is personal data on an open page exactly as it would be behind a login.
There is no "publicly available" exemption in either law that does the work people assume it does. The US has a patchwork where something closer to that intuition sometimes holds; Europe and Brazil do not.
The practical consequence is short: collecting is one question, storing is another, and storing is where you become responsible.
What actually changes the moment you store it
When you write that row to your database, you become what GDPR calls the controller and LGPD calls the controlador. You decided why the data exists and what happens to it, so the obligations are yours.
That means a legal basis for holding it — for most commercial scraping this is "legitimate interest", which is available but is not a magic word: it requires you to have actually weighed your interest against the person's, and to be able to show that you did.
It means the person's rights are exercisable against you. Access, correction, deletion, objection. Someone can ask what you hold about them, and "we scraped it from a public page" is not an answer to that question.
It means a retention period you can state. Not "forever, because storage is cheap."
And it means transparency, which is the awkward one: people are supposed to be able to find out you are processing their data. When you collected it directly from a platform rather than from them, GDPR has a specific provision for exactly this situation and it does not simply say "you are excused."
The two precedents worth knowing
hiQ v. LinkedIn (US) held that scraping public data is not "unauthorised access" under the Computer Fraud and Abuse Act. This is often quoted as "scraping is legal". What it actually settled is narrower and specifically American: reading public pages is not computer crime.
Meta v. Bright Data (2024) is the more useful one. It found that scraping while logged off is not bound by terms of service you never accepted — you cannot be held to a contract by browsing.
The corollary matters as much as the finding: log in, and the terms bind you. This is the single clearest line in the whole area. Collection from a logged-out public page and collection using an account are different legal situations, and the second one is a contract you agreed to and then broke.
Neither case touches data protection. Both are about access and contract. You can be entirely in the clear on both and still be a controller with unmet obligations, and that combination is where most people in this market actually sit.
Why the vendor's compliance page is not yours
Read the compliance pages of the vendors in this category and a pattern appears immediately: they describe their collection practices, and then push the storage question to the customer.
That is not sharp practice. It is accurate — they collect and hand it over; you decide what to keep and why. But it means the reassuring page you read before buying was answering a different question than the one you have.
It is worth saying plainly what this implies:
Buying from a vendor moves the collection question to them and leaves the storage question with you. There is no vendor who takes on your controller obligations, at any price.
If a vendor's marketing implies otherwise — that buying from them makes your storage compliant — that claim is doing work the law does not support.
Six questions worth answering before the first row
None of these require a lawyer to start on. All of them are much cheaper now than after you have a year of history.
- Why do I hold this? Write one sentence. If it comes out as "it might be useful", you have no basis and you have a retention problem forming.
- How long? Pick a number and enforce it in code. A deletion job that runs is worth more than a policy that reads well.
- What are the fields, exactly? Most collections hold far more than the product uses, because a parser grabbed everything on the page. Every field you do not need is exposure you did not need.
- What happens when someone asks me to delete them? Can you find every row about one person? If your schema cannot answer that, the obligation is unmeetable by construction.
- Am I logged in anywhere in this pipeline? If yes, you are in the contract case, not the Bright Data case. This is a bright line and it is worth being certain about.
- Would I be comfortable if the person read my privacy page? Not a legal test. But if the honest description of what you do would embarrass you, that is information.
What we do, since it is fair to ask
We collect logged out, from public pages, with no account on any platform for this purpose. That places us on the Bright Data side of the contract line deliberately rather than by luck.
We store six fields per item and refuse the rest: an id, the title or caption, the link, publication time, a score, and a comment count. No profiles, no follower counts, no avatars, no bios, and captions cut at 200 characters — enough to tell items apart in a list, not enough to reproduce someone's work.
Two exceptions we disclose rather than hide, because they are unavoidable rather than chosen. Some platforms put the author's handle in the post URL — tiktok.com/@handle/video/id is simply what the address is, and stripping it leaves a link that goes nowhere. And a caption written by a person sometimes mentions another person; we keep captions as written rather than editing someone's words.
There is a removal route and it is answered by a human. The full description is on the privacy page, which is deliberately written to be readable rather than to be survivable.
This is a real position with a real trade-off, and it is ours on purpose. If you would rather no collected source touched your work at all, the removal route applies to you and we will honour it.
The part I would tell a friend
The failure mode here is not a lawsuit. For a small builder, it is almost never a lawsuit.
It is opening a database eighteen months in, finding fields nobody chose to collect, having no idea why they are there, and discovering you cannot answer a deletion request because the schema was never designed to find one person. At that point the cheap fix has expired and the expensive one is a migration under time pressure.
The whole of the above collapses to one habit: decide what you keep, before you keep it. Everything else is downstream of that.
Written 7 September 2026. Not legal advice — a builder's map of the terrain. Data protection law and case law both move; verify anything you are about to rely on, and get real advice before operating at scale.