PETLP: A Privacy-by-Design Pipeline for Social Media Data in AI Research

Different rules apply depending on who you are: The paper shows that academic researchers at qualifying institutions have different legal rights to access social media data than commercial companies do. Specifically, researchers can sometimes override platform restrictions under European copyright law (DSM Article 3), while commercial entities must follow platform terms of service—a distinction that existing guidance often overlooks.

True anonymization of social media data is impossible: The authors demonstrate that social media data cannot be genuinely anonymized due to its public, traceable nature and unique characteristics. This means researchers must treat such datasets as containing personal data throughout their entire lifecycle, requiring ongoing privacy protections rather than assuming anonymization solves the problem.

Legal compliance should be built into research workflows from the start: PETLP embeds privacy safeguards directly into the technical process of collecting, processing, and sharing data rather than treating compliance as an afterthought. The framework treats Data Protection Impact Assessments as "living documents" that evolve throughout a project, rather than one-time checkbox exercises.

There's a critical legal gap around sharing trained models: The paper identifies uncertainty about whether researchers can legally distribute AI models trained on social media data, even if the original data collection was compliant. This gap means researchers may face legal risk when sharing their work, highlighting a need for clearer guidance on model distribution.

Researchers need unified guidance across overlapping laws: Social media research involves navigating GDPR, copyright law, and platform terms simultaneously, but existing frameworks don't integrate these domains. PETLP provides a practical structure to help researchers manage these overlapping obligations systematically.