GDPR mistakes on social media small firms make

Key takeaways

The common GDPR mistakes on social media are posting customer details in public replies, uploading customer lists for ads without a lawful basis, collecting personal data in direct messages with no privacy information, sending marketing messages without consent and loading tracking pixels before cookie consent. Most are fixed with a few habits and clear privacy information.

• Never post customer names, orders or addresses in public replies.
• Customer list uploads need a lawful basis and privacy information.
• Marketing messages generally need consent under PECR.
• Ad pixels need cookie consent before they load.

How does UK GDPR apply to social media?

UK GDPR applies whenever a business handles information about identifiable people, including on social media: replies that mention customers, photos of people, data collected in messages and lead forms, customer lists uploaded for ads and tracking on your website. PECR adds rules for electronic marketing and cookies.

• The most common social media marketing mistakes small businesses make
• GDPR and social media marketing in the UK

What are the most common mistakes?

The most common mistakes are habits that seem harmless until someone complains.

• Replying publicly with a customer's order or address.
• Uploading email lists for ads without telling customers.
• Asking for health or financial details in DMs.
• Sending marketing messages without consent.
• Pixels that load before cookie consent.

• Meta pixel mistakes: tracking ads without breaking the law

How do you fix them?

Move personal details to private channels, update your privacy information to cover social media, lead forms and ad audiences, record the lawful basis for each use, get consent for marketing messages and cookies, and avoid collecting sensitive data in messages at all.

• Posting customer photos without consent

Does a small business really need to worry?

Yes, but proportionately. The ICO's guidance for small organisations is practical. Most risk comes from a few habits, such as public replies with details and lists uploaded without telling customers. Fixing those covers most of the exposure.

How do you spot data protection risks in your social media?

Spot them by checking four places: public replies for customer details, direct messages for sensitive information, ad audiences for uploaded customer lists and your website for pixels that load before consent. Then check whether your privacy information mentions social media at all.

• Customer details in public replies.
• Sensitive data in direct messages.
• Lists uploaded without notice.
• Pixels loading before consent.

What does this look like in practice?

A pattern we see: a business replying to a delivery complaint on Facebook with the customer's full address and order number to prove it was delivered. A rule that replies never contain personal details, and that details move to private messages, prevents it.

• See client work
• Social Media Marketing for UK businesses

Data protection checklist

• No personal details in public replies.
• Privacy information covers social media.
• Lawful basis for every list upload.
• Consent for marketing messages.
• Pixels load only after consent.

• Social media giveaway mistakes that break the rules
• Posting customer photos without consent

Next step

Read your privacy notice and check it mentions social media, lead forms and ad audiences. If not, update it.