Is it legal to collect public Facebook data?
In the US, two leading cases have sided with collecting data anyone can see without logging in: in hiQ v. LinkedIn the Ninth Circuit found that reading public pages likely doesn't violate the CFAA, and in Meta v. Bright Data (N.D. Cal., January 2024) the court found Meta's terms didn't bar collecting public data while logged out. Personal data rules (GDPR in the EU and UK) still apply to what you collect and how you use it. This isn't legal advice.
Meta's official option
Meta's own options (the Graph API, the Ad Library API, and Meta Content Library for vetted researchers) come with Meta's terms and approval steps. If they cover your use case, they're the lowest-risk route.
How to do it with SocialAPIs
How SocialAPIs works: we read only public data that a logged-out visitor can see, without Facebook logins, cookies or fake accounts, and we don't access private profiles, private groups or messages.
Good to know
- hiQ later lost on a separate breach-of-contract claim, tied to LinkedIn's user agreement that it had accepted. In Bright Data, the court's point was that Meta's terms bind users while they're logged in.
- Personal data: names, photos and profile links of private people are personal data under GDPR. Collect only what you need, have a lawful basis, and handle deletion requests; that's your responsibility as the one using the data.
- Don't republish people's posts as your own content; monitoring, research and analysis are the usual uses.
- Not legal advice: check with a lawyer for your use case and country.