gdpr privacy youtube database
Can I legally sync and save YouTube comments on my website
<p>I own a YouTube channel and a website that belongs to it. On the website, I am also displaying the YouTube videos. For various reasons, I want to create a plugin to sync the comments on my YouTube channel with my website. This would mean saving those comments in my database.</p>
<p>Are there any legal implications to this? Privacy problems maybe? Can I get into trouble?</p>
<p>Im from Europe, The Netherlands</p>

<p>Probably not.</p>
<p>There are potential problems on the levels of copyright, data protection, and the Youtube terms of service.</p>
<p>You should assume that comments are typically covered by <strong>copyright</strong>. You do not have a license to these comments, only YouTube does. Therefore, YouTube can show the comments but you can't copy them – just like YouTube can stream your videos but others can't download them and host them on their own websites. To cover the copyright angle, you'd either need to obtain a license from the commenters, or get a sub-license from YouTube, or identify a suitable copyright exception.</p>
<p>The comments are personal data within the meaning of the <strong>GDPR</strong>, so that your processing of these comments (including mere storage) would be subject to GDPR as well. You need a legal basis for processing personal data. Which legal basis is suitable would depend on the purpose of processing, and on your relationship with the commenters. Potentially applicable legal bases in this context:</p>
<ul>
<li><p>you have a <em>contract</em> with the commenters that requires you to show the comments on your website. For example, I could see such a contract if there were a “featured comment” perk for a Patreon subscription. But this is not going to fly with random commenters.</p>
</li>
<li><p>you have a <em>legitimate interest</em> (LI) that allows the processing. A LI requires that you conduct a balancing test where you weigh this interest against the commenter's rights. This is very specific to the purposes for which you want to show the comments. However, a LI will generally only apply if you have an existing relationship with the commenters, making it possible for them to expect that this processing will occur – unlikely if you'll be scraping comments from YouTube.</p>
</li>
<li><p>you have obtained <em>consent</em> from the data subject. Consent must be specific, informed, freely given, and unambiguous – you can't obtain consent by writing “by commenting under this video you consent to XXX” in the video description.</p>
</li>
</ul>
<p>Regardless of legal basis, you would have to inform the commenters under Art 14 GDPR when you scrape their comments from the platform.</p>
<p>Finally, consider the <strong>platform terms of service</strong>. I have not read the YouTube ToS recently, so I don't know what their specific conditions are. But in general, such ToS will not allow you to scrape content from their platform in order to host it somewhere else. The ToS might allow certain actions like embedding a link/iframe to such videos on other sites, without allowing other actions such as copying other user's content to your site.</p>

<p>Re. the previous poster's comments about Personal Data ...  The UK GDPR definitions is: &quot;‘any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person&quot;.
From this description, comments added to a YouTube feed would only be classed as Personal data if they allowed a person to be identified.</p>
<p>Use of the comments remains problematic however since they are almost certainly captured by YouTube copyright as per the last poster's comments.  You still can't use them without getting prior permission!</p>
