A client's procurement team sends over a supplier questionnaire. One line asks which legal basis covers the personal data in the influencer research you delivered last quarter, and who the processor was. The account lead forwards it to you, because you picked the tool.
Most agencies have no ready answer, and most vendor sites do not supply one, because the category was built largely in the United States, where the assumption is that public data is fair game. That is not the European position, and the gap surfaces the moment a client's legal team gets involved.
None of what follows is legal advice. It is the shape of the framework, so you know which questions are the real ones.
Analysing a public profile is processing personal data
A creator's handle, follower count, engagement rate, estimated audience geography and posting schedule together identify a living person. Under Article 4(1) that is personal data, and the GDPR has no exemption for information that happens to be publicly visible. Publication changes the balancing calculation later; it does not put the data outside the regulation.
Two things follow. The vendor holding that index is a controller: it decided to collect the data and it set the purposes. And inference counts: an audience-country estimate or a composite score is not something the creator published, it is something a company produced about them, and derived data sits on the same footing as scraped data.
One sharper edge most vendor documentation skips: some niche labels sit close to the Article 9 special categories: mental health, religion, sexuality, political commentary. A niche tag is not automatically a health datum, but a system inferring "this audience is interested in weight loss" is nearer that line than its marketing suggests.
Legitimate interest is what the category rests on
Consent is not available at this scale. You cannot ask two hundred thousand creators before indexing them, and a consent-based index would be useless anyway: it would hold only the creators who already want to be found.
So every discovery tool, ours included, operates on Article 6(1)(f), legitimate interest. That is a genuine legal basis, not a loophole. But it is the only basis that arrives with conditions attached, and those conditions are where compliance actually lives.
A controller relying on it should be able to show three things: that the interest is legitimate and specific, that the processing is necessary rather than convenient, and that the creator's rights and reasonable expectations do not override it. Recital 47 makes reasonable expectation the pivot of that balancing test. A professional creator with a business account and a rate card expects to be evaluated by brands. A private individual whose account happens to be public does not. The same processing can pass for one and fail for the other.
Two obligations follow directly, and both are frequently missing:
- Transparency. Article 14 covers data not obtained from the person themselves: inform them within a month, unless that takes disproportionate effort, in which case a public notice does the work instead. The practical question is whether the notice exists, whether a creator could find it, and whether it describes what is actually happening.
- The right to object. Article 21 lets anyone processed under legitimate interest object, and the controller must stop unless it can show compelling grounds that override theirs. A tool with no route for a creator to object has not finished implementing the basis it claims.
Where the vendor's obligations end and yours begin
The vendor is a controller for its index. You are also a controller (not a processor, and usually not a joint controller either) from the moment you export a set of profiles into a deck. You decided which creators to extract, why, and who would see the result. That is a separate processing operation, on your own legal basis, in your own records.
So a few unglamorous things are yours: a line in your Article 30 register for influencer research, a retention rule for the shortlists sitting in a shared drive, and a defensible answer on necessity. A deck carrying full audience demographics for forty creators when the campaign will book five is hard to defend as necessary. Cutting it back to the people under real consideration is better client work and better data minimisation at once: one reason the step where a long list becomes a shortlist deserves more care than it gets.
Handing that deck to the client makes them a controller too. Someone should decide that deliberately rather than discover it in a questionnaire.
Where the data sits, and why a European client asks
Storage location is not a technicality for an EU client, and for public-sector or regulated ones it is often a contractual requirement no adequacy argument satisfies.
Transfers outside the EEA need a Chapter V mechanism: an adequacy decision, standard contractual clauses backed by a transfer assessment, or one of the narrow derogations. The EU–US Data Privacy Framework, adopted in 2023, carries much of this traffic, and its two predecessors were struck down. A tool whose entire stack sits in the United States is a dependency on a decision neither you nor your client controls.
Ask for the subprocessor list, not the headline hosting region. Scraping infrastructure, the cloud host, the analytics layer and, increasingly, whichever model provider classifies creator content all touch the data. That last one is new enough that plenty of processing agreements have not caught up. These belong alongside the commercial questions you are already asking when comparing discovery tools.
What to ask before you sign
Send these in writing. The quality of the reply is itself the signal.
| Ask | A good answer sounds like | A warning sign |
|---|---|---|
| Your legal basis, and is the balancing test written down? | "6(1)(f), and here is our assessment." | "The data is public." |
| How do creators learn you hold data on them? | A findable notice naming the actual processing. | The generic website privacy policy. |
| What happens when a creator objects or asks for erasure? | A named route, a timeframe, and it survives re-crawls. | "They can email support." |
| Where is data stored, and who are the subprocessors? | A current list, plus notice before it changes. | A region name and nothing else. |
| How long is a profile kept once an account is dormant or deleted? | A defined period with a deletion trigger. | Silence, or "indefinitely". |
| Will you sign a DPA covering the AI components? | Yes, subprocessors enumerated. | A DPA predating the features you are buying. |
What this article cannot settle
The honest version, since the point is not to sound more certain than the situation allows.
- This is a framework, not advice. National implementations differ, sector rules layer on top, and a qualified adviser or your own DPO signs off on anything consequential. Treat this as the questions, not the answers.
- Legitimate interest is an assessment, not a permission. It can be sound for a category and wrong for one operation within it. Regulators have published no guidance aimed squarely at influencer discovery, so anyone speaking with total confidence, vendors included, is overstating what is settled.
- Documents are not practice. A signed DPA and a well-drafted notice tell you what a vendor committed to, not what its crawler does on a Tuesday.
- Compliant is not the same as comfortable. A creator who finds out they were scored and ranked without ever hearing from anyone may have no legal complaint and a reasonable commercial grievance.
- The rules move. Adequacy decisions get litigated, and the DSA and the AI Act reach into adjacent ground.
Lyren processes public data only, under Article 6(1)(f), and is operated by WELCO AI S.R.L. in Romania, an EU controller under the same regime as your agency, not a US vendor leaning on an adequacy decision. Creators can object at hello@lyren.io. Put every question in the table above to us as well; a vendor that flinches at them is telling you something. Access is invite-only through the waitlist while EU coverage is built out.