If you operate a B2B product that ingests public data from social platforms, forums, or review sites, you live in a legal gray area that is rapidly becoming less gray. European courts and data protection authorities have spent the last three years drawing clearer lines around what "public" actually means under the GDPR, and many vendors that assumed public-equals-free-to-use are now facing enforcement actions. This post explains how Anvil thinks about the law and what we require from customers using our platform.
The core question: what legal basis applies?
Article 6 of the GDPR lists six possible lawful bases for processing personal data. For scraping-style lead generation, only two are realistic candidates: consent under 6(1)(a) and legitimate interests under 6(1)(f). Consent is effectively impossible to obtain from a stranger on Xiaohongshu, so the entire industry operates under legitimate interests — or operates unlawfully. Most vendors pick door number two without actually satisfying the legal test. Do not be that vendor.
The three-part legitimate interests test
To rely on legitimate interests, a data controller must pass a three-part balancing test. European DPAs look for documentation of all three parts — "we thought about it" is not enough.
- Purpose test: The interest must be real, specific, and legitimate. "Generic lead generation" fails. "Identifying beauty brands actively searching for a CRM replacement, so we can offer a relevant solution" passes.
- Necessity test: The processing must be necessary to achieve the interest, and there must be no less intrusive alternative. If you can get the same outcome from an opt-in newsletter, you cannot claim scraping is "necessary".
- Balancing test: Your interest must not be overridden by the rights and freedoms of the data subject. The more sensitive the data, the less likely legitimate interests will carry.
Practical rules we enforce in Anvil
Anvil ships with guardrails that make compliant use the path of least resistance:
- Public data only: We do not scrape content behind logins, paywalls, or age gates. If a platform restricts crawlers via robots.txt or ToS, we respect it.
- Purpose limitation by project: Every Anvil project requires a written purpose statement that is stored alongside every lead record. This maps directly to Article 5(1)(b) purpose-limitation.
- Short retention windows: Leads default to thirty-day retention unless converted. We refuse to store scraped personal data indefinitely.
- Right-to-object by default: Every lead record carries a "rtbf_token" that, when invoked through our Data Export & GDPR Requests endpoint, deletes the lead and all its downstream traces.
- No special-category data: Our scoring engine is trained to ignore signals about health, sexuality, religion, political views, or trade-union membership. If the model surfaces such a signal, it is dropped before storage.
The customer half of the contract
Compliance is a shared responsibility. Anvil provides the tooling; the customer remains the data controller. Our Data Processing Addendum (DPA) requires customers to:
- Document the legitimate-interest assessment for each use case.
- Deliver a privacy notice to data subjects at the first point of direct contact (e.g. the first outbound email) per Articles 13-14.
- Honor data-subject requests within thirty days.
- Avoid using scraped data for automated decision-making under Article 22 without additional safeguards.
What about the US, UK, and APAC?
The GDPR is the strictest major framework, so designing for it tends to satisfy other jurisdictions. The UK GDPR is functionally identical post-Brexit. California under CCPA/CPRA has narrower rules but expanding; PIPL in China has stricter cross-border transfer rules that we handle via in-region data residency. Singapore PDPA and Japan APPI broadly track the GDPR philosophy. Hong Kong PDPO, where Anvil is headquartered, is less prescriptive but its data-protection principles map cleanly onto the GDPR six-basis model.
Bottom line
Compliant scraping is not an oxymoron — it is just harder than most vendors are willing to admit. If you are choosing a lead-gen platform in 2026, ask for the DPA, ask how they implement the balancing test, ask where personal data is stored and for how long, and ask how they honor erasure requests. A vendor who cannot answer those four questions in detail is a liability you do not want on your vendor list.