Guides · 2026-11-07

GDPR and social media APIs: a checklist for agencies and companies

A publishing tool sits between your content and the platforms. That makes it part of your data processing. This article explains the roles, the contracts and the technical questions you should ask before you connect accounts.

When you schedule videos through an API, personal data moves through several hands: names and faces in the videos, captions with customer names, account details of the people who connect their channels, and the access tokens of the platforms. Under the GDPR, each of these steps needs a clear role and a legal basis. This is not legal advice, but a practical overview of the questions that come up.

Who is responsible for what

Three parties are involved, and the GDPR treats them differently.

The tool acts on your instruction, so you need a data processing agreement (DPA) under Art. 28 GDPR with it. Once the post is on YouTube, TikTok or Instagram, the platform processes it in its own responsibility. That is why a platform is not a sub-processor of your tool: you choose the platform and have your own relationship with it.

For agencies there is one more layer. If you publish for clients, your client is usually the controller and you are their processor, and the tool becomes a sub-processor. Your own DPA with the client should then name the tool.

Questions to ask a provider

Where are the servers?

Ask for the hosting provider and the location of the data centre, not just "EU". Video Automation runs on our own servers in a STRATO data centre in Berlin. Payment is handled by Stripe (Stripe Payments Europe, Ireland) and e-mails are sent through IONOS in Germany. The DPA lists all sub-processors.

How long are videos stored?

A publishing tool needs the file until every platform has received it. After that, there is little reason to keep it. Look for a fixed retention period. In Video Automation uploaded media are kept for the retention period of your plan (3, 7, 14, 30 or 90 days) and then deleted automatically.

Are media publicly reachable?

Some platforms do not accept a file upload but download the video from a URL. Instagram, Facebook and Threads work this way. A tool must therefore make the file temporarily available on the internet. Ask how: with an unguessable, signed URL that expires, or with a predictable link? Video Automation uses signed URLs that cannot be guessed and stop working when the media are deleted.

How are access tokens protected?

Tokens allow posting in the name of an account. They should be encrypted at rest, and only the scopes that are needed should be requested. Video Automation stores tokens encrypted with AES-256-GCM and uses the official OAuth sign-in of each platform; for Bluesky an app password is used, which you can revoke at Bluesky at any time.

Does the tool track anyone?

A tool that only publishes has no reason to track visitors of its website or the people in your team. Ask whether the website uses analytics or third-party content. Our website uses neither and sets only technically necessary cookies.

Data subject rights in practice

Two groups can ask for their data: the people in your team, and the people who connected a social account, for example a client's employee who linked a company page.

For your team, you need an export and a way to delete a workspace. In Video Automation you can export your workspace as JSON and delete it immediately in the app.

For connected social accounts, the platforms have their own mechanisms. Meta sends a data deletion callback when a user removes an app in their Facebook or Instagram settings; the tool should delete the connection and give a confirmation code with a status page. TikTok sends a deauthorization event. Google lets users remove access in their account settings. Our data deletion page explains each route, and the privacy policy lists which data we receive from each platform.

Transfers outside the EU

The social platforms themselves are mostly based in the US or have US parent companies. When you publish there, you transfer content to them, and their own privacy terms apply. That is a decision you take when you choose to publish on a platform, independent of the tool. What you can control is that the tool in between does not add further transfers. Check whether the tool uses US cloud storage, US e-mail services or analytics. For Stripe, transfers to the US are covered by the EU-US Data Privacy Framework and standard contractual clauses, as described in our privacy policy.

A short checklist

1. Sign the DPA with the tool and file it with your records of processing.
2. Note the platforms you publish to as independent recipients in your own privacy notice.
3. Check the retention period for uploaded videos and choose a plan that fits.
4. Give team members only the roles they need; Video Automation has team roles for this.
5. Use connect links for client accounts instead of asking for passwords.
6. Document how a client can revoke access, both in the tool and at the platform.
7. Remove accounts you no longer publish to.

Conclusion

A GDPR-compliant setup for automated posting is mostly about clarity: who decides, who processes, where data lies and when it is deleted. If a provider can answer these questions with names and numbers, you are on solid ground. Our plans and their retention periods are on the pricing page; common questions are answered in the FAQ. If you are moving from another service, the article on the Upload-Post alternative describes the switch.