Most of my freelance work is the unglamorous side of social media: figuring out whether an account is healthy, whether a creator’s audience is real, and whether a campaign moved anything. Over time, I stopped doing this by hand and started building small scripts and dashboards around public data. That is where the uncomfortable question showed up: just because I can read something without logging in, should I be collecting it, storing it, and charting it?
This is the checklist I now run before I build anything that touches other people’s public profiles. It is opinionated, it is not legal advice, and it comes from mistakes I made on small projects.
1. “Public” is a setting, not a licence.
A public profile means the owner chose to let strangers look at it. It does not mean they agreed to be tracked, profiled, or archived forever. The practical test I use: would the person be surprised to see what I built from their data? A weekly follower count for a brand account is unsurprising. A timeline of when one private individual follows and unfollows a particular person is surprising, and I will not build that.
2. Collect the minimum, aggregate early.
The easiest way to stay out of trouble is to never store what you do not need. For audience analysis, I almost never need individual identities. I need counts, rates, and distributions: followers over time, average likes per post, posting cadence, which hashtags travel with higher engagement. So, my pipeline aggregates immediately and discards the row-level data, rather than hoarding it “in case it is useful later.”
- Store numbers about accounts, not dossiers on people.
- Prefer business, creator and brand accounts over personal ones.
- Set a retention window (mine is 90 days for raw snapshots) and actually delete.
3. Respect the platform’s own rails first.
Before scraping anything, check what the platform already gives you. For your own Instagram account, Insights covers reach, follower demographics and content performance, and “Download your information” exports your followers and following lists as files you own. Both are official, stable, and free. Any third-party tool should be judged against that baseline: if the official export answers your question, use it.
Third-party tools earn their place when you need something the native tools do not do, such as looking at a competitor’s public numbers or tracking changes over time without a spreadsheet. I use igtrackr for the quick public-profile checks, mostly because it works from public data only and does not ask for an Instagram password. That last point is a useful filter in general: any tool that wants your login to show you public information deserves suspicion.
4. Be a polite client.
If you do fetch public pages yourself, treat the server like a neighbor’s:
- Rate-limit aggressively. A few requests a minute is plenty for a human-scale task.
- Cache what you fetch so you never ask twice for the same thing.
- Back off on errors instead of retrying in a tight loop.
- Read the terms of service. Some platforms prohibit automated collection outright, and “everyone does it” is not a defence.
- Never bypass a login wall, a CAPTCHA or a rate limit. If the platform is trying to stop you, that is your answer.
5. Design for the person on the other end.
Ask what happens if your output is wrong or gets shared. Follower “authenticity scores” are a good example. A score that says an account is 38% fake sounds precise, but it is a model’s guess. If a brand drops a creator over a guess, a real person pays for your false precision. I label estimates as estimates, show the inputs, and keep verdict-style language out of the interface.
6. Rules of thumb on data you should not touch.
- Anything behind a private account, a login, or an invite.
- Minors’ accounts, even if technically public.
- Location traces and anything that could help someone find a person offline.
- Data you plan to join with other sources to re-identify someone.
7. Give people an exit.
If you store data about identifiable accounts, publish a way to ask for removal and honour it quickly. It costs almost nothing, and it forces you to keep your data organised enough to find a specific account and delete it.
What this looks like in practice.
My current setup for client work is deliberately boring. Official exports and Insights for the client’s own account. Public, aggregate numbers for a handful of named competitors or creators. A weekly snapshot, a simple chart, and a deletion job. No private profiles, no personal-account tracking, no credentials in anyone’s hands but the client’s.
It is slower than hoarding everything and sorting it out later. It is also the version I can explain to a client, a platform, and the people whose profiles I looked at, without flinching. If you are building anything that analyses public social data, my one piece of advice is to write that explanation first. If you cannot write it comfortably, change the design, not the explanation.
Disclosure: I am connected to the team behind igtrackr, the tool mentioned above, and I have tried to describe the official alternatives fairly.
