The most widespread misconception in web data collection is that information anyone can see online is outside privacy law. It is not. Under the EU's General Data Protection Regulation (GDPR), personal data stays personal data wherever it appears, and California's Consumer Privacy Act (CCPA) excludes only a specifically defined kind of publicly available information. The six myths below are the ones that most often lead projects into trouble. The corrections describe what is generally true; how the rules apply to a specific project depends on the jurisdiction, the data and the use, so a lawyer familiar with data protection should review any plan that involves personal data.
Myth 1: If it is publicly visible, privacy law does not apply
Under the GDPR, personal data means any information relating to an identified or identifiable person. A name on a public profile, a username, a photo or a comment is personal data whether it sits behind a login or on an open page. Public visibility can affect how an organization assesses its lawful basis and the expectations of the people involved, but it does not take the data out of scope.
The CCPA is different in form, and the difference is often misread. It excludes publicly available information from its definition of personal information, but the exclusion is defined: broadly, information lawfully made available from government records, or information a business reasonably believes the consumer or widely distributed media made available to the general public. That is not the same as everything that can be scraped from a website, and it does not cover inferences drawn from the data.
A practical correction: for any field that could identify a person, assume privacy law applies until a lawyer tells you otherwise.
Myth 2: The GDPR only matters for companies based in the EU
The GDPR applies to organizations established in the EU, and also to organizations outside the EU when they offer goods or services to people in the EU or monitor their behavior there. Collecting and analyzing data about people in the EU, for example tracking what they post or building profiles of them, can fall under monitoring of behavior.
A US company that collects reviews from European users to analyze their sentiment over time therefore cannot assume the GDPR is irrelevant because its servers and staff are in the United States. Several other countries have privacy laws with similar reach, which is one more reason the answer depends on where the people in the dataset are, not only where the collector is.
Myth 3: Removing names makes the data anonymous
Deleting the name column rarely makes data anonymous. Usernames, profile photos, exact timestamps, locations and the text of posts can identify a person on their own or in combination. Data that can be linked back to someone with additional information is pseudonymized, not anonymized, and the GDPR treats pseudonymized data as personal data.
A hypothetical test shows the gap: take one record from a dataset with names removed and search a distinctive phrase from the post text. If the original post and its author appear, the record still identifies someone. Hashing usernames does not solve this either: a hash of a public handle can be recomputed by anyone who has the handle, so the record remains linkable. True anonymization usually requires aggregation, such as counts per day or per topic, or removing enough detail that re-identification is no longer reasonably possible. The post on ethical web scraping and data privacy standards covers how minimization fits into a collection plan.
Myth 4: Every collection of personal data needs consent
This myth runs in the opposite direction and leads people to think compliance is impossible, so the rules get ignored altogether. The GDPR lists several lawful bases for processing personal data, and consent is only one of them. Legitimate interests is the one most often considered for collection of public data, and it requires a documented balancing test: the organization's interest, whether the processing is necessary for it, and whether the interests and rights of the people involved override it.
That test is real work, not a formality. Collecting public posts about a product to measure overall sentiment is a very different case from building contact lists of individuals. Gathering email addresses or phone numbers from websites to send unsolicited marketing raises separate rules on electronic marketing in many countries, on top of the privacy questions, and falls outside responsible data collection. Whatever basis applies, it should be decided and written down before collection starts.
The balancing test also shapes the design of the project. Collecting fewer fields, excluding profiles of private individuals, aggregating early and keeping data for a shorter time all make the balance easier to defend. Collecting special categories of data, such as health, religion or political opinions inferred from posts, makes it much harder and brings stricter rules under the GDPR, so a project that touches those topics needs legal review before the first request.
Myth 5: People do not need to be told because the data came from public pages
The GDPR's transparency obligations also cover personal data that was not collected directly from the person. In general, the organization must provide information about who it is, what it does with the data and the rights people have. There are exceptions, including where providing the information would involve disproportionate effort, but relying on them requires its own assessment and safeguards, such as a publicly available privacy notice describing the collection.
The CCPA also expects businesses to describe their data practices in a privacy policy and to respond to requests from consumers, such as requests to know or delete information. Whether the CCPA applies to a given business also depends on thresholds set in the law, such as revenue or the volume of consumer data handled, which is one more point to confirm rather than assume.
The practical step is the same under both laws: be able to explain what you collect, why and how someone can ask for their data to be removed, and have a process that actually finds and deletes their records.
Myth 6: Once collected, data can be kept for as long as it might be useful
The GDPR's storage limitation principle says personal data should be kept no longer than necessary for the purpose it was collected for. "It might be useful someday" is not a purpose. Platform and API terms often add their own rules, such as removing content the author has deleted.
The correction is to set a retention period per dataset when the project starts, tied to the purpose, and to automate deletion when that period ends. A hypothetical example: a campaign analysis that needs three months of public posts can keep raw posts for the analysis period, keep aggregated results longer, and delete the raw records afterwards. When collection is outsourced to a managed service such as ScrapingIsNotACrime, the contract should state the retention period and who performs the deletion, so the obligation does not fall between the two parties. The overview of emerging legal frameworks in social media scraping discusses how these expectations are developing.
