Guidelines 08/2020 on the targeting of social media users

What it covers

These guidelines clarify the roles and responsibilities of social media providers and targeters when personal data is used to target social media users with tailored messages. They analyse the legal basis for targeting based on provided, observed and inferred data, transparency and right of access obligations, DPIA requirements, and the treatment of special categories of data including data made manifestly public.

Why it matters

It is the key reference for allocating controller responsibilities and identifying lawful bases in advertising and political targeting arrangements built on social media platforms, following the CJEU Wirtschaftsakademie and Fashion ID judgments.

Refer to it when

• structuring a joint controller arrangement between a targeter and a social media provider
• assessing the legal basis for an ad-targeting campaign
• evaluating whether inferred data constitutes a special category of data
• conducting a DPIA for a targeting mechanism
• responding to a data subject access request about targeting criteria

Questions this document addresses

• Who is a controller, joint controller or processor in a social media targeting arrangement?
• What legal basis can be relied on for targeting based on provided, observed or inferred data?
• When does inferred or combined data become a special category of data?
• What must the essence of a joint controller arrangement under Article 26(2) contain?
• When does the manifestly public exception under Article 9(2)(e) apply?

Topics

• Social media
• Controller & processor
• Lawful basis
• Transparency