Is story tracking illegal?

Some providers systematically track all Instagram Stories, regardless of whether the creators have given their express consent. This practice may not only violate Instagram's terms of use, but may also conflict with the General Data Protection Regulation (GDPR), which regulates the handling of personal data in a business context.

Instagram and the Meta Group only allow the automated tracking of stories under certain conditions. For example, influencers must authenticate their Instagram Business account and tag the brand in their stories, which is why reliable companies such as IROIN® limit themselves to tracking stories within campaigns and do not include them in influencer searches or store them in databases for years. If you see that stories are immediately available in the search, you should pay particular attention and not trust that everything is legally secure.

The GDPR sets clear requirements for the processing of personal data. Storing and analyzing Instagram Stories without the explicit consent of the data subjects may violate several principles of the GDPR:

• Lawfulness, fair processing, transparency (Art. 5 para. 1 lit. a GDPR): Data must be processed in a lawful manner and in a way that is comprehensible to the data subject.

• Purpose limitation (Art. 5 para. 1 lit. b GDPR): Data may only be collected for specified, explicit and legitimate purposes and may not be further processed in a manner incompatible with those purposes.

• Data minimization (Art. 5 para. 1 lit. c GDPR): Only such data may be collected necessary for the purposes of the processing.

Since stories are only online for 24 hours and blanket storage does not serve a clear business purpose, blanket tracking is therefore problematic and potentially illegal without the express consent of the influencer. Some providers therefore advertise that stories can be viewed directly during research. However, if you take a closer look, it is often only selected profiles that have explicitly signed up - these are rarely high performers, especially in Germany, Austria and Switzerland.

IROIN®'s responsible approach

At IROIN®, compliance with data protection regulations and platform guidelines is our top priority. We deliberately refrain from blanket tracking of all Instagram Stories. Instead, we enable the tracking of Instagram Stories as part of campaign management. In this way, we ensure that there is a clear necessity for the fulfillment of the business activity, which also has a time limit - thus clearly taking into account essential components of the GDPR.

Using IROIN® Connect, you as a brand or agency can invite creators to link their profiles to IROIN® for you. You can set a time limit for this and thus retain full control over the sharing of your story insights. If an influencer agrees to activate IROIN® Connect, there is no need to collect the data points of all Instagram Insights, as all information is immediately displayed in your campaign. This means that all parties involved in a collaboration can focus on creating content and no longer have to worry about handling the data. If IROIN® Connect is not used, all Story Insights must be entered manually and a lot of data from posts or reels cannot be entered automatically.

You can write to creators directly within IROIN® by using our tempalte or let AI help you create your own texts. As soon as an influencer agrees, this is stored in the portfolio on IROIN® and everyone in the team knows internally.