Fulfilling data access obligations: How could (and should) platforms facilitate data donation studies?

1. Introduction

Digital platforms, such as Facebook, Instagram, and YouTube, provide information for citizens across the globe (Newman et al., 2023). When people use digital platforms, they leave digital traces that researchers can deploy to study human behaviour (Freelon, 2014; Keusch & Kreuter, 2021). However, researchers often face challenges in accessing such digital trace data (de Vreese & Tromble, 2023). Digital platforms and, relatedly, corporations, such as Meta and Google, store data in proprietary archives, rendering them de facto gatekeepers of research agendas (Ausloos & Veale, 2021).

In light of this limitation, researchers have developed approaches for obtaining digital traces, including negotiating with platforms (Dommett & Tromble, 2022), setting up research collaborations between platforms and researchers (Wagner, 2023) and using tools provided by platforms (e.g. application programming interfaces [APIs]¹). They also employ more adversarial methods that do not rely on the goodwill of platforms to share data (e.g. scraping; for overviews, see Mancosu & Vegetti, 2020; Ohme et al., 2024).

Researchers have also begun capitalising on data access provisions in the law (Ausloos & Veale, 2021; Bruns, 2019; Freelon, 2018; Halavais, 2019), especially the right of access in the General Data Protection Regulation (GDPR). The GDPR grants data subjects, that is, identifiable persons to whom information relates (Art. 4(1) GDPR), the right to obtain a copy of all personal data that platforms process about them. Digital platforms or data controllers as actors determining the purposes and means of this processing (Art. 4(7) GDPR) are obliged to enable such access. In particular, Art. 15 of the GDPR requires platforms to give data subjects, i.e. platform users, access to a copy of their personal data and information on how data was processed.

This article discusses how platforms could and potentially should enable research with a focus on data rights based on the GDPR (see similarly European Digital Media Observatory, 2022), although our analysis also applies to more recent frameworks, such as the Data Act (DA), the Digital Markets Act (DMA) or the Digital Services Act (DSA). Individuals can also exercise data access rights as provided by the DMA (Art. 11) and the recently adopted DA (Art. 5(7)). For research purposes, accountability, and pro-competition aims, selective data access rights can similarly be exercised under the DSA (Art. 40) and the DA (see further Leersen, 2024; Veale, 2023). While we focus on the GDPR, our discussion also holds implications and recommendations for the DA, the DMA, and the DSA (see also Ausloos et al., 2023).

In pace with these legal requirements, researchers have begun developing research designs that rely on access provided through GDPR regulation. In so-called data donation studies, researchers ask platform users to request their data from platforms. Ideally, platform users can access and store such data in the form of data download packages (DDPs), that is, files containing their personal data. Individuals can then donate their DDPs to researchers via data donation tools (DDTs)², such as Port (Boeschoten et al., 2022) or the Data Donation Module (Pfiffner et al., 2024b). These tools extract and anonymise relevant data from platform users’ DDPs on the subjects’ devices as a form of privacy-by-design; afterwards, they send the data to researchers (van Driel et al., 2022). Data donation studies have, for example, been used to study how citizens use social media platforms to stay informed or message friends (Hase & Haim, 2024; van Driel et al., 2022), whether they employ search engines to search for political information (Blassnig et al., 2023) or to detect depression-related behaviour by social media users (Kmetty & Bozsonyi, 2022).

As user-centric approaches (Halavais, 2019), data donation studies build on the informed consent of users and make use of rights featured in data protection laws (for an overview of laws beyond the EU, see Greenleaf, 2021). While data donation studies have often been employed in the context of Europe, researchers have also started to rely on this approach elsewhere, for example in China (Wu-Ouyang & Chan, 2023), India (Garimella & Chauchard, 2024) or Pakistan (Ejaz et al., 2023). Under the GDPR, platforms are obliged to comply with data access rights. However, a growing body of case law (Case C‑487/21; GDPR Hub, 2020) and empirical research (Ausloos et al., 2020; Syrmoudis et al., 2021) paints a problematic picture of how these rights are implemented. This has also been underlined by concerns in response to the call for evidence related to the DSA (European Commission, 2023; see similarly van Drunen & Noroozian, 2024).

In this paper, we combine perspectives from legal scholars and social scientists engaging in data donation studies. First, we discuss the data access obligations in the GDPR, specifically legal requirements to provide accessible, transparent, and complete data. Second, we draw on the experiences of social scientists who engage in data donation studies to identify challenges resulting from platforms’ inadequate compliance with such requirements. To do so, we combine a structured review of challenges researchers encountered across data donation projects with a study on variation in data request/access. Third, by combining a legal and social scientific perspective, we formulate four recommendations for the enforcement of data access rights to improve platform user empowerment and data donation studies.

Our goal is twofold: first, we aim to stimulate discussions among social scientists relying on the right of access to conduct data donation studies. Second, we translate our concerns for a broader group of stakeholders, including companies, data protection authorities, and policymakers. By combining both perspectives, we engage in interdisciplinary efforts to improve data access, as demanded, for instance, by Tromble (2021).

2. Legal background to the right of access in the GDPR: Why and how platforms need to provide users access to their data

2.1 Normative underpinnings of the right to access

The exponential growth of data brings about social, legal, and ethical concerns related to the asymmetries of information and power (Beer, 2017; Kitchin, 2017). Information asymmetries result from the complexity of data infrastructures and engineered opaqueness by those controlling them (Ausloos & Veale, 2021; for an extended discussion, see Nieborg et al., 2024). Power asymmetries stem from the ability to exploit infrastructures in light of commercial or political imperatives at the expense of individuals, communities, and society at large (Giannopoulou et al., 2022). One of the key objectives of data protection law is to challenge these asymmetries by providing effective and complete protection of the fundamental rights of natural persons with respect to the processing of personal data (Case C-131/12; Case C-73/16). The right of access constitutes a cornerstone in this regard (Case C-553/07). As a first objective, this right functions as an emancipatory legal tool. It empowers platform users by making data infrastructures visible, allowing them to govern the use of their data and enabling them to exercise other rights (e.g. to have data erased or ported to other platforms; see also C-434/16 as well as joint cases C-141/12 and C-372/12). A second objective is to enable platform users to monitor platforms’ compliance with the GDPR (Case C-434/16; Recital 63 GDPR), including lawfulness, purpose limitation, data minimisation, accuracy, and storage limitation. The right of access is intent-agnostic, meaning that it does not require a motivation vis-à-vis platforms (Case C‑307/22; Mahieu, 2023). It can be invoked to safeguard interests, rights, or freedoms, such as non-discrimination.

2.2 Requirements of the right to access

We now briefly introduce the legal framework with which data platforms must comply when responding to users’ access requests (for an overview, see Mahieu, 2023). This framework is dynamic, as its interpretation is the topic of a growing body of case law by national courts, the Court of Justice of the European Union (CJEU), and data protection authorities (DPAs).

Art. 15 of the GDPR contains content requirements that specify what data platforms need to provide on request, for example, the purpose of the data processing, the type of data processed, or the recipients of the disclosed data. Art. 12 mainly defines formal requirements (including obligations) that have been further clarified by the European Data Protection Board (EDPB, 2023). In short, platforms must inform platform users in a concise and easily accessible way, information must be presented in a transparent way, and platforms must provide complete information.

2.2.1 Concise and easily accessible form

GDPR Art. 12(1) requires platforms to provide access in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. As explained by the EDPB (2023), “the controller should provide appropriate and user-friendly communication channels that can easily be used by the data subject” (p. 3).

2.2.2 Transparency

It is critical to consider data rights in light of the GDPR principle of transparency. Platforms are obliged to support users in their efforts to benefit from the protection of their fundamental rights; they have to actively implement data rights (Art. 25(1) GDPR) and facilitate the exercise of such rights (Art. 12(2) GDPR). These requirements are closely linked to the right of access according to the transparency obligations required by Art. 5(1)(a) and Art. 12(1) (see also Art. 29 Working Party, 2018). Platform users are entitled to be informed, at an individualised level, about data processing. This means that platforms are required to tailor responses to access requests to specific users. This is especially relevant for the data categories listed in GDPR Art. 15(1), such as the processing purposes of personal data, the identity of who the data have been shared with, what has been shared, etc. Mere referrals to platforms’ privacy policy, often phrased in generic terms, do not meet this requirement.

2.2.3 Completeness

Platform users are entitled to full disclosure on all information processed by platforms, including (i) information relating to content requirements laid down in Art. 15(1)–(3) and (ii) information held throughout platforms’ IT and non–IT filing systems. Platforms might enable users to download data by providing self-service tools; however, such tools should never limit the scope of users’ entitlements. Platforms could provide users with vast data files that may be complete but do not meet the conditions of information being offered in a transparent and easily accessible manner (see Section 2.2.1). Instead, platforms might consider providing layered information while bearing in mind that providing only a summary will not meet the requirement of completeness. Depending on the reasonable expectations of users, platforms must select a strategy that meets this requirement and demonstrate that it adds value to users (Ausloos et al., 2020; EDPB, 2023). In any case, when asked to provide all personal data, platforms cannot limit responses to parts of the respective data. Even more, platforms may be required to provide additional information necessary to understand respective data sets (see also Case C‑487/21).

3. Methodology

These three requirements will now serve as points of reference to discuss challenges in data donation studies that emerge from platforms’ non-compliance with legal frameworks. To identify challenges, we rely on a structured review of challenges researchers encountered in data donation projects and a systematic study on data request/access across platforms.

3.1 Structured review

We systematically reviewed challenges encountered in previous or on-going data donation projects. Researchers engaged in such projects were identified through related conferences, such as yearly data donation symposia. Second, researchers who had already published related projects were contacted as well. Third, and as a form of snowball sampling, identified researchers were asked to think of additional scholars who conduct similar projects (but may not yet have published related work). By doing so, a total of twelve data donation projects were identified. These projects have been running across different years (2018–2024) and collecting DDPs from various digital platforms (Facebook, Google, Instagram, Netflix, TikTok, WhatsApp, X/Twitter, YouTube; for an overview, see Table 1). However, and as should be noted critically, most projects were conducted by researchers in Western Europe, thereby limiting the generalisability of our results, since data donation studies are also employed elsewhere (Ejaz et al., 2023; Garimella & Chauchard, 2024; Wu-Ouyang & Chan, 2023).

Researchers identified challenges they had encountered in their data donation projects through virtual brainstorming. Here, researchers described relevant challenges and noted examples for how these became prevalent. Lastly, a core team of authors discussed and sorted the fourteen challenges into the legal requirements of concise and easily accessible form (see Challenge I–VII), transparency (see Challenge VIII–XI), and completeness (see Challenge XII–XIV). Table 2 depicts challenges encountered across projects (for details, see Tables A2.1, A2.2, A3, and A4 Supplement).

3.2. Study on data request/access across platforms

Related to the requirement of concise and easily accessible form, we further analysed Challenges I–VII to understand how data requests and data access differ across platforms and time (for similar approaches see Pins et al., 2022; Syrmoudis et al., 2021, 2024; Wong & Henderson, 2019). We requested and downloaded DDPs for those six platforms most frequently studied across identified projects (Facebook, Instagram, TikTok, Twitter/X, WhatsApp, and YouTube; see Table 1). As part of the D3I volatility project (Carrière et al., 2024), initial data collection was conducted between January and May 2023 by researchers in the Netherlands. To account for variation over time as well as within-country variation, two researchers at Utrecht University and two researchers at LMU Munich repeated the process in May 2024. Table 3 depicts the results of this updated data collection.

4. Challenges in data donation studies due to platform non-compliance

Based on our findings, platforms seemingly fail to comply with requirements related to the right of access. This affects not only platform users, who may have trouble accessing their data, but also researchers, who face increasing drop-out rates and biases in data donation studies (see for example Hase & Haim, 2024; Pfiffner & Friemel, 2023). Most importantly, by impeding access rights and, consequently, data donation studies, platforms hamper studies on questions of societal relevance, such as platform users’ exposure to misinformation, how platforms affect individual well-being, or the role of algorithmic recommendation (see further Ohme et al., 2024).

4.1 Concise and easily accessible form

According to GDPR Art. 12(1), platforms should present DDPs so that platform users can easily understand their content. However, we identified seven challenges impeding the fulfilment of this requirement (for variation in request/access, see Table 3; for Challenges I–VII, see Table 4).

Challenge I. Instance restrictions

Social media users often consume content from platforms via smartphone apps. However, our review indicates that if users want to request or download their data from these platforms, they can often only do this via web applications accessible through browsers, for example via desktop computers. In two-thirds of the data donation projects, researchers encountered such restrictions (see Table 2). For example, social media users often consume YouTube content via smartphone apps. However, if they want to access their data, such requests can only be filed through the web application in the browser where they have to login again and with which they may not be familiar. While this was more often the case up until 2023 (see projects 6–7, Table A.2.1), our study on data request/access indicates that most platforms – except for Twitter/X and YouTube – have lifted instance restrictions by May 2024 (see Table 3).

For users, such additional steps pose an unnecessary burden. Importantly, platforms cannot require that users submit requests in a certain form (EDPB, 2023). Ease of accessibility implies that users should be able to submit access requests through interfaces based on which they use platforms. For researchers, such restrictions are difficult in that they lower response rates: respondents often report that technical difficulties, for example, switching application instances between platform use and data requests, lead them to drop-out in studies related to digital trace data (Gil-López et al., 2023). Attrition may not only increase costs for data donation studies. Systematic drop-out may lead to biased samples, for example if technically less savvy users cannot participate (Hase & Haim, 2024). Overall, instance restrictions could thus limit the generalisability of findings stemming from data donation studies.

Recommendation: Platforms should enable data request/access via all instances through which platform users can use their infrastructure (i.e. via apps and browsers).

Challenge II. Interfaces

Platform users may encounter different interfaces when requesting or accessing DDPs: when submitting access requests through an app, for example WhatsApp, interfaces can depend on operating systems (see project 8, Table A.2.1). Moreover, platforms sometimes perform design experiments, leading to further variation (see project 7, Table A.2.1). Additionally, verification procedures for accessing DDPs often vary: some platforms ask for verification via two-factor authentication (2FA) or even hardcopy identification via official IDs (see projects 4, 6, 9, or 11, Table A.2.1; see similarly Pins et al., 2022; Syrmoudis et al., 2021; Wong & Henderson, 2019).

While, from a user perspective, data should be appropriately secured, varying security measures make it challenging for researchers to guide users through access requests. Respondents who are concerned about their privacy are often less likely to participate in data donation studies. As such, heightened security measures, such as sending in an ID, may further bias studies in that privacy-concerned participants drop-out (Hase & Haim, 2024), which would limit the generalisability of findings.

Recommendation: Platforms should standardise interfaces and verification procedures across instances (see Challenge I), operating systems, user profiles, and platforms. Platforms could facilitate access by providing a consistent link where subjects can request data. Moreover, platforms should refrain from interface design experiments or they should announce such as part of public data documentation (see also Section 4.2).

Challenge III. Limiting requested data

Often, platform users cannot indicate which type of data or for which time data should be included. In more than two-thirds of the data donation projects, researchers encountered related challenges (see Table 2), many of which are still prevalent according to our study on data request/access in May 2024 (see Table 3).

From a data protection-by-design perspective, platform users should be able to download only parts of their data (Syrmoudis et al., 2024). This allows users to feel empowered, for example, because they can exclude sensitive data. Moreover, downloading all data increases the risks of data breaches on users’ devices. For researchers, limiting access requests is relevant as this could reduce the size of data, which makes it easier to process DDPs. According to our review, large DDPs often led to participants failing to upload their DDPs, which may introduce bias (see project 6, Table A.2.1).

Recommendation: Platforms should allow access requests to be restricted to specific data points while retaining the ability to download all data (see Section 4.3.). Filtering options should be tied to a consistent link for data access requests.

Challenge IV. Diverse DDP formats

Only some platforms provide options to choose the format in which DDPs can be accessed. This includes JSON formats (JavaScript Object Notation formats) or CSV formats (Comma-Separated Values formats), which are more easily readable for machines. It extends to HTML formats (Hypertext Markup Language formats), which are more easily readable for humans (see similarly Pins et al., 2022; Syrmoudis et al., 2021; Wong & Henderson, 2019). According to our review, researchers considered this a challenge in two-thirds of the data donation projects (see Table 2). To date, most platforms still provide diverse formats, as indicated by our study on data request/access (see Table 3).

Although there is no explicit requirement for machine readability in the GDPR, its intention to enable platform users to port data certainly prompts a machine-readable option vis-à-vis the explicitly required readability for humans. For users, this means that both human- and machine-readable formats should be provided to understand but also port data. For researchers, diverse file formats are, however, problematic in that users may wrongly request DDPs in human- instead of machine-readable data, which requires increased resources for data processing via DDTs.

Recommendation: Platforms should offer at least one machine-readable format. They should turn this file-format selection into an opt-out prompt so that a machine-readable option is included by default, while also providing a human-readable option.

Challenge V. Multiple access requests

Some platforms do not enable users to request their data via single access requests. For example, if users want to access WhatsApp data, they have to export each chat separately (see project 8, Table A.2.2).

For users, multiple access requests mean more effort. In turn, researchers may have to grapple with missing data precisely because users do not want to engage in multiple access requests. Oftentimes, users have trouble finding respective buttons on digital platforms (Pins et al., 2022). For example, if participants have to export each WhatsApp chat separately, this complicates the analysis of social interactions (Kohne & Montag, 2023).

Recommendation: Platforms should centralise access requests via a single link. Here, platform users should be able to request all their data via a single request and download it in a single DDP.

Challenge VI. No notification about DDPs

According to the GDPR, platforms must comply with access requests within 30 days. In practice, large platforms often comply within a couple of days, as indicated by our review (see projects 4 and 10, Table A.2.2; see also Wong & Henderson, 2019). However, time periods between platform users requesting their data and DDPs being accessible differ across platforms and users. Neither platform users nor researchers can estimate when DDPs will be ready. This is cumbersome, especially since DDPs are often deleted after a few days (see Challenge VII).

Moreover, platforms often use different means – e.g. emails or push notifications – to inform platform users that DDPs are available, as indicated by our study on data request/access (see Table 3). If platform users rarely use platforms, such notifications may go unnoticed and DDPs may be deleted before they can be accessed. Some platforms, such as TikTok, did not provide notifications in previous years (see projects 10 and 11, Table A.2.2), although this seems to have changed by May 2024 (see Table 3).

Recommendation: Platforms should inform users at the moment of their access requests of when their DDPs will be available and send notifications once DDPs are accessible. Preferably, this should be done via email rather than notifications on platforms, or in combination, as users who rarely use platforms may miss the latter.

Challenge VII. Limited access over time

Access to DDPs often expires a couple of days – according to the review (see Table 2) and the study on data request/access between four days and thirty days after the data became available (see Table 3).

As such, platform users may miss the opportunity to download and store their data, especially if platforms do not notify them (see Challenge VI). For researchers, this complicates the process of data collection: they have to remind participants to download and donate their DDPs within this time frame, which may lead to low response rates in data donation studies.

Recommendation: Platforms should standardise and extend the time during which DDPs can be downloaded. This should be a more reasonable amount of time, at least thirty days, especially since platforms themselves need to respond to access requests within thirty days.

4.2 Transparency

According to GDPR Art. 5(1)(a) and Art. 12(1), platforms must transparently provide platform users with information on data processing. However, we identified four challenges impeding the fulfilment of this requirement (for Challenges VII–XI, see Table 5).

Challenge VIII. No information on completeness of DDPs

To assess whether platforms provide users with complete data, it is necessary to determine what information platforms collect and store (Rau, 2023). Without this information, users cannot know whether platforms fulfilled their obligation. According to our review, researchers in all twelve projects critically discussed that it was unclear if any data is missing, mostly because platforms did not provide information on what data was collected in the first place (see Table 2). Some projects indicated that it was clear that data was missing, for example, because participants indicated that data was absent from their DDPs (see project 4, Table A3), similar to existing studies (Syrmoudis et al., 2024).

For users, this is problematic as they cannot know whether they can access all data platforms collected on them. For researchers, missingness could introduce bias, for example, if data is systematically missing for some participants or platforms but not others.

Recommendation: Platforms should publish a complete and legally binding list of the information (i.e. “variables”/“features”) they collect and store about users as part of public data documentation.

Challenge IX. No information on DDP structure

Almost equally as often, researchers encountered the challenge of platforms lacking transparent information on what files in DDPs signify (see Table 2). While some file names are seemingly self-explanatory, others are not. Furthermore, DDPs sometimes combine different types of information in the same list, making it difficult for users to understand where they can access which information. For example, watch and search histories stored in DDPs from YouTube contain a mix of forced-to-view content, such as advertisements, and self-selected content (see projects 6 and 10, Table A3). For users, this makes it hard to understand their DDPs. For researchers, this may introduce measurement error, for example, when studying how users select and consume information on platforms. If they do not know which content users choose to watch (as opposed to being shown as part of advertisement), this complicates analysis, for example, on the effects of political campaigns on platforms during elections.

Second, platforms use different file or variable names in DDPs, depending on users’ devices or account settings. For example, Google relies on localised file names, while Instagram uses localised variable names according to individual language settings (see projects 2 and 4, Table A3). This complicates data portability for users. Similarly, it may introduce measurement error in data donation studies. Thus, platforms should be transparent about how account settings affect DDPs. Ideally, data provided in a machine-readable format, such as JSON or CSV, should always look the same, regardless of individual settings.

Recommendation: Platforms should provide a description of all the variables collected as part of public data documentation, including a description of files in DDPs (van Driel et al., 2022). This extends to using the names of standardised files, variables, and values in machine-readable DDPs, for example, via consistent date formatting according to ISO 8601. These recommendations have also been supported by recent CJEU case law, which explained that additional information may have to be provided “where the contextualization of the data processed is necessary in order to ensure the data are intelligible” (Case C‑487/21, para. 41).

Challenge X. No information on DDP measurements

Platforms do not provide information on how they measure variables (Nonnecke & Carlton, 2022; Rau, 2023), an issue mentioned throughout our review. One example is information on exposure, such as “seen videos” (example file from YouTube DDPs). Here, it is unclear whether the content is marked as “seen” once it appears on a user’s display or only after the content was displayed for a certain amount of time. Moreover, DDPs can also include information that is algorithmically derived. Such information is not a direct measurement of actions by users (e.g. clicking a link) but results from algorithmic classifications based on, for example, users’ past actions. An example would be “inferred interests” for advertisements (example file from Instagram DDPs). Without contextual information on classification algorithms, it is difficult for users to understand such data (Cotter et al., 2021; Rieder & Hofmann, 2020).

For users, missing information on measurements makes it impossible to understand what information platforms collect on them. For researchers, it complicates addressing measurement error and, thus, may bias results. For example, when spotting that algorithmically inferred travel modes in DDPs from Google are likely invalid (e.g. measures indicating that users completed a trip of 200 km by foot in 30 minutes, see project 5 in Table A3), researchers cannot correct such errors because they do not know how measurements were created.

Recommendation: As part of public data documentation, platforms should provide a description of how measures were created. This includes indicating when measurements were algorithmically inferred, in which case platforms should provide information on the algorithms used for inferences, the variables used as inputs for classifications, and what the potential outputs are.

Challenge XI. No information on DDP changes

Platforms often change the content and structure of DDPs. This includes altering variable names, file names, or the format in which the information is provided, adding new variables or removing variables. Such changes can make it difficult to compare DDPs across time (Rieder & Hofmann, 2020; van Driel et al., 2022). Additionally, unexpected changes add obstacles for researchers engaged in data donation studies. For example, Google started to provide different file formats throughout a data donation study from our review without any information prior to this change. When researchers contacted the platform, they did not receive any response on how to fix this (see project 2, Table A3).

For users, shifts in how and what data is provided make it harder to access data. For researchers it could – as a worst-case-scenario – lead to a sudden halt of on-going data donation studies.

Recommendation: Platforms should announce and document changes made to the structure of DDPs and included measurements before they take effect – at least 30 days in advance – as part of public data documentation.

4.3 Completeness

According to Art. 15(1)–(3) of the GDPR, users are entitled to full disclosure of all available information that platforms process on them. This includes metadata (e.g. which data is collected and how it is used) according to Art. 15(1) and information on data transfers (e.g. whether this data is transferred to other organisations) according to Art. 15(2). It extends to a copy of the data platforms collect according to Art. 15(3), which should include all this information. However, we identified three challenges impeding the fulfilment of this requirement (for Challenges XII–XIV, see Table 6).

Challenge XII. Missing data on activities

Oftentimes, platforms provide incomplete information on user activities (van Driel et al., 2022), such as the overall time spent on platforms. This extends to more passive activities, such as the content that users watched or were exposed to. In previous years, such exposure information was, for example, not included in the DDPs from Facebook or Twitter/X (see projects 1 or 9, Table A4) although newer DDPs now include this information, which indicates that such data is, in fact, collected by platforms.

For users, this means that they cannot see what activity-related data platforms process on them. For researchers, it undermines studies on questions of societal relevance. For example, data donation studies cannot study exposure to misinformation on digital platforms, as exposure data is often missing from DDPs (Ohme et al., 2024). To understand the role of misinformation on social media during elections, researchers currently rely on other means of data access, like research collaborations with platforms (Wagner et al., 2023).

Recommendation: Platforms should provide complete information on all activities related to platform users, including the time they spent on a platform as well as passive (e.g. watching content) and active (e.g. searches) activities.

Challenge XIII. Missing data on content

Platforms often provide incomplete information regarding the content that users were exposed to or actively interacted with. DDPs from YouTube, for example, often contain links to or IDs of accounts that platform users follow rather than account names (see projects 10–11, Table A3), although such information is available as meta data.

For users, this means that they would have to look up such content manually, which requires an unrealistic degree of effort to understand, for example, how they were targeted by advertisers on digital platforms. Even more troublesome, researchers have to look up such information via APIs, given the amount of data included in DDPs. Seeing that most platforms shut down or drastically restrict their APIs (Bruns, 2019; Freelon, 2018), this renders data donation studies unfeasible.

Recommendation: Platforms should provide complete information on content, both related to what the content is about and the names of the accounts publishing it. Information that can only be provided by APIs should be included in DDPs.

Challenge XIV. Missing data on contexts

Lastly, platforms rarely provide access to necessary context information for users to fully understand their behaviour on digital platforms, contrary to the GDPR requirements specified by the CJEU (Case C‑487/21). Most DDPs include a list of user activities or the content users engaged with, but it remains unclear how such engagement came about, as indicated by our review (see Table 2): DDPs do not indicate whether the content users engaged with was recommended to them or whether they encountered it elsewhere, for example, through messages by friends. In turn, it is impossible for users to understand non-exposure or non-engagement: since DDPs do not contain information on which videos were visible or recommended to them, they cannot determine which content they could have watched or liked but did not.

This lack of information is especially troublesome in light of the DSA where Art. 34(1)(c) underlines the importance of assessing the systemic risks created by platforms, including “actual or foreseeable negative effects on civic discourse and electoral processes and public security”. For example, to understand the spread of political ads or misinformation during electoral processes, researchers require data on how such content was promoted to users. Here, the DSA offers a pathway for data access that may strengthen data donation studies. To understand how civic discourses emerge and may be harmed, both platform users and researchers need access to contextual information, including feeds as streams of information on platforms.

Recommendation: Platforms should provide contextual information on activities and content, for instance, as metadata (i.e. whether or not content was recommended to platform users by platforms; timestamps) and by providing access to feeds on platforms.

5. Improving the right of access: Four recommendations for the road ahead

Our empirical investigation underscores that platforms’ non-compliance with the GDPR data access rights has a significant impact on users, but also researchers, engaging in data donation studies. While platforms allow platform users to exercise these rights de facto somehow, platforms’ compliance does not necessarily hold up with a stricter de-jure interpretation (Ausloos et al., 2020; de Vreese & Tromble, 2023). By complicating the exercise of data access rights (in a concise and easily accessible form), by not communicating what various data points mean or where they originate from (transparency), and by providing only some of the data they collect on users (completeness), platforms constrain the scope of the right of access.

This becomes even more problematic as other roads to data access, for example, collaborations between researchers and platforms, cannot – and, arguably, should not – become the standard (Wagner, 2023). Such collaborations depend on the goodwill of platforms and limit the degree of control researchers have over samples or measurements. Moreover, researchers involved in such collaborations often stem from more resourceful countries from the Global North, which may narrow research foci and the generalisability of results, as Parry (2024) critically points out.

Instead of being able to conduct research with data that should be available pursuant to the GDPR, researchers are, to date, forced to argue and deal with illegitimate behaviour from platforms. Platform users, in turn, cannot use DDPs to understand their behaviour on digital platforms. We think that these challenges could – and in light of our legal understanding of the matter should – be overcome. This would be for the greater good of platform users, research and, finally, society, where solutions to problems such as the spread of misinformation require independent research. To illustrate the road ahead, we propose four central recommendations (see Figure 1) for how platforms could (and should) facilitate data donation studies.

Recommendation 1. Platforms should provide a central link for data access

Related to Challenges I–VII and the requirement to provide data in a concise and easily accessible form, platforms must facilitate data access. This includes the possibility of exercising data access rights independent of instances, individual settings, or usage. Across and between platforms, this also requires interoperable formats, such as machine-readable DDP’s consisting of JSON or CSV files in ZIP packages via an opt-out function. DDPs should be available for at least 30 days. Lastly, platforms should standardise security measures, including how users are notified about their data being available. A persistent link where platform users can request their data, including the possibility to filter for data points, would benefit users and researchers who could more easily direct study participants to the right location in data donation studies. In line with common “forgotten password” security measures, such a persistent link could request that platform users provide their login credentials (e.g. their email address or phone number) and verification via 2FA (e.g. via smartphones for app-based platforms or via email for browser-based platforms).

Recommendation 2. Platforms should provide public data documentation

Related to Challenges VIII–XI and the requirement of transparency, platforms should not be the de-facto gatekeepers of research agendas. While it is not the primary goal of the GDPR to facilitate research, recent frameworks such as the DSA have further strengthened data access rights, especially for researchers (Leersen, 2024) and for questions of high societal relevance. As such, platforms should facilitate independent research by providing public data documentation detailing data origins, levels of retrievable data, operationalisations, measures of completeness, and transparency about algorithmic inference. This includes standardising the names of files, variables, and values in DDPs. Any changes to data structures and measures should be communicated in advance.

Recommendation 3. Platforms should provide complete data

Related to Challenges XII–XIV and the requirement of completeness, platforms must provide complete data. This includes data on activities, content, and contextual information, for example as-of-yet often missing data on what content users are exposed to on digital platforms or how they are exposed to such content.

Recommendation 4. Platforms should enable data-access mandates

Lastly, we consider data-subject-centric designs the most beneficial route forward for platforms, users, and researchers. While our first three recommendations are more closely tied to existing legal requirements, a mandate for data portability has been suggested by Art. 20 of the GDPR. Deployed through platforms, users could be equipped with the ability to issue data-access mandates, signalling platforms to provide access to data on their behalf (see similarly Nonnecke & Carlton, 2022). Portability could allow users to issue mandates to researchers to access, for example, exposure data within a given time frame or advertisement users were targeted with. This would enable users to reign over their data and who shall have access to it. For platforms, it would provide a consistent pattern of data provision and specify clear boundaries alongside which they can operate sustainably. Finally, it would allow researchers access to machine-readable data without the burden of supporting a wide variety of access-right exercises while ensuring users’ approval. In turn, this would benefit researchers’ autonomy when studying digital public spheres, civic discourse, and democratic processes and how platforms influence these dynamics.

6. Conclusion

Our study illustrates that platforms do not comply with legal requirements related to data access rights: they do not provide accessible, transparent, and complete data to platform users. Not only could this undermine users’ trust in and use of platforms (Syrmoudis et al., 2024). It also hampers research aiming to address questions of societal relevance, such as how misinformation on digital platforms may interfere with elections or the reduced digital well-being of users as an outcome of platform usage. As Parry notes, research and, as such, society at large, currently risks “being left behind without any robust means of studying the potential systemic risks at play” (2024, p. 2). Independent research could address these issues – and platforms could (and should) support this through compliance with data access rights.

Our four central recommendations could be implemented in several ways. First, researchers and policymakers should lobby for their inclusion in legal frameworks, for example related to the upcoming delegated act on data access in the DSA (Windwehr & Selinger, 2024). This includes clear guidelines on what data and documentation platforms should provide (Jaursch et al., 2024). Second, researchers themselves could and should develop guidelines on data access rights, for example protocols on data handling (Tromble, 2021; see for example European Digital Media Observatory, 2022) or research ethics (Lukito, 2024). Third, researchers and especially policymakers should monitor (Leersen, 2024) and, where applicable, sanction non-compliance with data access rights. Recent examples include observing users during data access requests (Pinks et al., 2022; Syrmoudis et al., 2024) or providing status reports for researchers on data access across platforms (European Commission, 2024a). In terms of sanctioning, the investigation of the European Commission related to Meta’s non-compliance with the DSA offers a warning for platforms going forward (European Commission, 2024b). Lastly, researchers, policymakers, and platforms should collaborate to extend existing and propose new infrastructures for improving data access (Jaursch et al., 2024; van Drunen & Noroozian, 2024). Here, research institutions and politics need to provide funding for research infrastructures to ensure that a diversity of researchers can partake in data access (Nonnecke & Carlton, 2022).