Social media recruiting can be GDPR-compliant if every step has a legal basis and a notice: the Meta pixel on your careers page needs consent (Art. 6(1)(a) GDPR plus the ePrivacy rules on device access), the application itself rests on Art. 6(1)(b), and a talent pool needs separate, time-limited consent. Use the WhatsApp Business Platform with opt-in, not a private phone. This guide follows EU law and German implementation; UK rules differ in detail. As of October 2026. This is not legal advice.
Who is the controller, and where does data flow?
The employer that advertises the job is the controller under Art. 4(7) GDPR, even if an agency or software runs the campaign. Social media recruiting creates data at five points: ad delivery and measurement (pixel, Conversions API), the lead form, the chat (WhatsApp), pre-screening, and applicant management (ATS, talent pool). Each needs its own rule.
| Step | Legal basis | Duty |
|---|---|---|
| Meta pixel, Conversions API, retargeting | Consent, Art. 6(1)(a) GDPR and ePrivacy rules on device access | Consent banner before loading, joint-controller arrangement (Art. 26) |
| Lead form | Art. 6(1)(b) GDPR (application) | Privacy notice (Art. 13), only necessary fields |
| WhatsApp chat | Art. 6(1)(b); lit. (a) for promotional content | Business Platform, opt-in, processor contract (Art. 28), check third-country transfer |
| AI pre-screening | Art. 6(1)(b) or (f) | No solely automated rejection (Art. 22), information about the logic |
| Applicant file | Art. 6(1)(b), national rules such as § 26 BDSG in Germany | Deletion concept, about six months after rejection in Germany |
| Talent pool | Consent, Art. 6(1)(a) GDPR | Separate consent, time limit, withdrawal |
The legal framework: Art. 6, Art. 88 GDPR and national law
Art. 88 GDPR lets member states adopt more specific rules for employment data, expressly "for the purposes of the recruitment". Germany did so in § 26 of its Federal Data Protection Act. In case C-34/21 (30 March 2023) the Court of Justice held, on a near-identical Hessian provision, that such a national rule is only applicable if it meets Art. 88(2). In practice, controllers rely additionally on Art. 6(1)(b) (steps taken at the request of the data subject before entering into a contract) and document why each data field is necessary.
The cost of getting it wrong is real: fines up to €20 million or 4 % of worldwide annual turnover (Art. 83(5)), plus damages claims under Art. 82.
Ads and the Meta pixel
A website operator that embeds a Meta pixel is a joint controller with Meta for collection and transmission of the data. The Court of Justice decided this for a social plugin in Fashion ID (C-40/17, 29 July 2019) and held that the operator must obtain visitors' consent. This brings a joint-controller arrangement under Art. 26 GDPR, covered by Meta's "Controller Addendum", and a duty to inform visitors.
- Consent before loading: the pixel reads and stores information on the device, so besides the GDPR the ePrivacy rules require consent (in Germany § 25 TDDDG, in the UK PECR). Use a banner with equal "Reject" and "Accept" buttons and no pre-ticked boxes.
- The Conversions API is not a loophole: server-side events still concern people and must not go to Meta without consent.
- Retargeting applicants: add visitors to audiences only with consent. Without it, you rely on location radius and ad copy, as Meta's employment ad category already assumes.
- Company pages: page insights also create joint responsibility (C-210/16, 5 June 2018).
Lead forms and landing pages
Applicants fill in a form voluntarily, but you must inform them first (Art. 13): who is responsible, what the data is for, how long it is stored, who receives it and which rights apply. Link the privacy notice in the form itself. Three rules apply:
- Data minimisation (Art. 5(1)(c)): name, contact channel, location and two to four must-have criteria are enough. No mandatory CV, no date of birth, no photo.
- No special categories (Art. 9): questions on health, religion, trade-union membership or disability do not belong in a first contact.
- Clarify roles: check against Meta's current terms who processes the form data in which role, and export leads into your own system promptly instead of leaving them in the ad account.
WhatsApp: Business App or Business Platform?
| WhatsApp Business App | WhatsApp Business Platform (API) | |
|---|---|---|
| Address book | Matched like the regular app | Not synchronised |
| Processor contract | Practically not possible | Via a Business Solution Provider, Art. 28 GDPR |
| Fit for applicants | A few chats only, problematic | For volume and automated flows |
The address-book matching of the regular and the Business app is the main reason practice guides advise against private use: phone numbers of people who never consented are transmitted to Meta. For applicant chats, use the Business Platform through a provider. In addition:
- Opt-in in the first message, freely given (Art. 7), with purpose, duration and withdrawal. Promotional follow-ups need their own consent.
- Third-country transfer: the adequacy decision for the EU-US Data Privacy Framework has applied since 10 July 2023. The General Court dismissed the Latombe challenge (T-553/23) on 3 September 2025; Latombe appealed on 31 October 2025 (C-703/25 P). Keep a fallback ready, for example standard contractual clauses.
- In practice: our guide on contacting candidates via WhatsApp covers the full flow with a consent text and question list.
AI pre-screening: Art. 22 GDPR and the AI Act
If an AI pre-qualifies applicants, Art. 22 GDPR applies: a decision with legal or similarly significant effect must not be based solely on automated processing. In SCHUFA (C-634/21, 7 December 2023) the Court of Justice made clear that even a score can count as a decision if the recipient relies on it decisively. For recruiting this means:
- A person decides on invitation and rejection and can depart from the result.
- Applicants are told under Art. 13(2)(f) that automated pre-screening takes place and the logic behind it.
- For high-risk setups, consider a data protection impact assessment (Art. 35).
- AI Act: AI systems for recruitment and selection are high-risk (Annex III). Under the Digital Omnibus, in force since 27 July 2026, those duties apply from 2 December 2027. Ask your vendor for its plan today.
Applicant file, talent pool and retention
Applicant data serves the selection process, not other purposes. Storage for about six months after a rejection is common in Germany, because applicants must claim under § 15(4) AGG within two months and then have three months to sue (§ 61b ArbGG). That is a practice period, not a statutory number: document your reasoning. Other member states and the UK have their own limitation periods, so check local guidance.
To keep applicants for future roles you need a separate, voluntary, documented consent that can be withdrawn at any time (Art. 7(3)). Common guides cite six to twelve months as a reasonable pool period; after that you re-ask or delete. The advantage of an own talent pool is that consent, retention and deletion sit in one place instead of with a platform you cannot access.
Data subjects can request access (Art. 15), rectification (Art. 16), erasure (Art. 17) and object (Art. 21). You must respond without undue delay and within one month (Art. 12(3)).
Checklist: 10 points before the campaign starts
| # | Check | Done when |
|---|---|---|
| 1 | Consent banner | Pixel loads only after consent |
| 2 | Arrangement with Meta | Art. 26 / Controller Addendum reviewed |
| 3 | Privacy notice in the form | Art. 13 information linked |
| 4 | Data minimisation | Only fields the selection needs |
| 5 | WhatsApp Business Platform | Provider, processor contract, opt-in text |
| 6 | Third-country transfer | DPF certification or SCCs documented |
| 7 | Human decision | No solely automated rejection |
| 8 | Deletion concept | Retention per data type set and implemented |
| 9 | Talent pool consent | Separate, time-limited, revocable |
| 10 | Record of processing | Social media recruiting listed (Art. 30) |
Where Sprad fits in
Sprad Social Recruiting runs your job ads on Instagram and Facebook, an AI talent agent pre-screens every applicant via WhatsApp, phone or web, and every applicant lands in your own talent pool. The contacts stay with you instead of a platform, and consent and retention can be managed in one place. Pricing is ad spend plus 10 %, from a €1,000 budget. Legal assessment of your set-up remains with your data protection officer, who should be involved before launch.
FAQ
Is social media recruiting with Meta ads GDPR-compliant?
Yes, if you obtain consent for the pixel and retargeting, review the Art. 26 arrangement, inform applicants under Art. 13 in the form and set retention periods.
Do I need consent for the Meta pixel?
Yes. The pixel stores and reads information on the device and sends data to Meta, so consent is required before it loads.
Can I message applicants on WhatsApp?
Yes, via the WhatsApp Business Platform with opt-in and a privacy notice. The regular Business app is problematic because of address-book matching.
How long can I keep applicant data?
In Germany about six months after rejection is common. A talent pool needs consent; six to twelve months is a typical period.
Is AI pre-screening allowed?
Yes, as long as the AI does not solely decide on rejection or invitation (Art. 22 GDPR) and applicants are informed.
Does Art. 88 GDPR apply to applicants?
Yes, it expressly covers recruitment. After C-34/21, also rely on Art. 6(1)(b) GDPR.
Jürgen Ulbrich
Jürgen Ulbrich has more than a decade of experience in developing and leading high-performing teams and companies. As an expert in employee referral programs as well as feedback and performance processes, Jürgen has helped over 100 organizations optimize their talent acquisition and development strategies.
