GDPR Checklist for Social Recruiting

What's Included in This GDPR Checklist for Social Recruiting

A job ad on Instagram or Facebook looks like a marketing task, but it triggers several data protection and equal treatment questions before the first applicant arrives: a pixel that reads visitors, a lead form that collects personal data, a WhatsApp chat that stores conversations, and an audience that Meta builds on your behalf. This Word checklist walks you through all of them in eight blocks and 46 checks, so nothing is discovered after the campaign is live.

Every check comes with a legal basis and a column for who ticked it off and when. The eight blocks are:

1. Pixel, Conversions API and consent. When tracking may load, what counts as valid consent and how joint responsibility with Meta is handled.
2. Lead forms (instant forms). Information duties, data minimisation, legal basis and separate consents.
3. WhatsApp: Business App or Business Platform (API). Why the choice matters, first contact, AI disclosure and automated decisions.
4. Processing agreements and service providers. Who needs a contract, what it must contain and how roles are split with an agency.
5. Retention periods and deletion concept. How long applicant data may stay and how deletion is proven.
6. Talent pool and consent. Why keeping applicants for later needs its own consent and how to run it.
7. AGG-compliant ads and targeting. Neutral wording, images, audience selection and claim deadlines.
8. Meta ad category Employment. What the special category changes for planning and how to document Meta's rules.

The document also contains a short guide, a page for open points with owner and deadline, and a closing note on what the checklist is and is not. It is written for Germany and the EU, with the legal basis named for each point.

Key Features That Save You Time

• Legal basis per check. Instead of "check data protection", you get the article, section or ruling, for example Art. 28 GDPR for processing agreements or Sec. 25 TDDDG for the pixel. That tells your data protection officer exactly what you are asking.
• Built for the social recruiting chain. It follows the path an applicant takes: ad, click, form or chat, storage, talent pool, deletion. You can check one stage at a time.
• Honest about open questions. Where the law is contested or has no fixed value, the checklist says so. The six-month deletion period, for example, is a practice value and not statutory text. The scope of Sec. 26 BDSG has been disputed since a 2023 ruling of the Court of Justice, so Art. 6 GDPR is cited in parallel.
• Tick boxes and sign-off column. Each point has a box and a field for who confirmed it and when, so the finished list doubles as evidence for your records.
• Open points page. Everything you cannot confirm yourself goes on a table with name and date.

How to Use This GDPR Checklist

1. Print or open it before the briefing. Run through the list when you plan the campaign, not when the first ad is approved.
2. Tick what you can prove. A point is done when a document, a setting or a contract shows it. "We think so" stays open.
3. Write an owner and a date next to every open point. Use the last column and the open points page at the end.
4. Take the open points to your data protection officer or counsel. The legal basis column tells them what the question is about.
5. Start the campaign when all points are closed or consciously accepted. Accepted risks should be noted with a name.
6. Review every six months. Meta, WhatsApp and AI rules change. Note the review date in the document.

This checklist is orientation and not legal advice. It does not replace the review of your individual case. State of the document: October 2026.

Why This Checklist Works

It covers the whole chain, not one tool. Most data protection guides on social recruiting stop at the cookie banner. The real exposure often sits elsewhere: in the lead form that asks too much, in a WhatsApp account that matches the phone's address book, or in an applicant database that nobody deletes.

It separates law from habit. A checklist that mixes statutory requirements with common practice makes people over- or under-comply. Here, each point shows which one it is, so you can decide knowingly where you have room.

It connects data protection and equal treatment. Ads for jobs are also subject to the German General Equal Treatment Act (AGG), and Meta limits targeting for job ads through its Employment category. Looking at both together avoids a campaign that is lawful on privacy but discriminatory in its audience, or the reverse.

It makes the work visible. A ticked, dated list shows an auditor, a works council or a customer that you looked at the right questions, even if some points remain open for a reasoned decision.

Who Should Use This Checklist

• HR and recruiting teams planning their first or next campaign on Instagram and Facebook.
• Data protection officers who are asked to review a social recruiting setup and want a structured starting point.
• Owners and managing directors of employers in care, trades, logistics, hospitality or retail who hire without a legal department.
• Agencies and freelancers running job ads for clients, who need to settle roles and contracts early.

If you want applicants to land in a pool you control: Sprad Social Recruiting runs job ads on Instagram and Facebook (Google and TikTok are to follow). An AI talent agent pre-screens every applicant via WhatsApp, phone or web, and every applicant lands in your own talent pool, so the contacts stay with you rather than with a platform. Pricing is ad spend plus 10 %, from a €1,000 budget that can be split across roles, with three months as the recommended duration. There is no guarantee of a number of applicants. See Sprad Social Recruiting.

FAQs

Do I need consent for the Meta Pixel on my career page?

In most cases yes. Reading information from the visitor's device, which the pixel does, requires consent under Sec. 25 TDDDG, and the later processing needs a legal basis under the GDPR, usually consent as well. The pixel should load only after the visitor has opted in. The checklist lists the points to verify, including how the Conversions API fits in.

Is the WhatsApp Business App enough for applicant communication?

Often not. The Business App can match contacts from the device address book with WhatsApp, which is hard to square with data minimisation. The Business Platform (API) runs through a provider and allows a processing agreement and controlled use. The checklist covers both options and the points to settle before the first message.

How long may I keep applicant data?

The law sets no fixed period. Many employers delete rejected applications about six months after the process ends, in line with the deadlines for claims under the AGG. Keeping data longer, for example in a talent pool, needs the applicant's separate consent. The checklist covers both.

Can I target job ads by age or gender?

Not as a rule. Meta's special ad category Employment restricts such options depending on region, and under the AGG a selection by age or gender can be an indication of discrimination. Steer reach through region, radius, role and ad content instead. Check Meta's current policies before you plan, because they change.

Does this checklist replace legal advice?

No. It orders the usual checks and names the legal bases, and it gives you better questions for your data protection officer or counsel. It does not assess your individual case.