This article is a general introduction to the topic, not legal advice. Before rolling out automated moderation at scale, consult your data protection officer or a lawyer familiar with your organisation’s specifics.

Does GDPR even apply to public Facebook comments?

Yes — a public comment together with the author’s name and profile picture is personal data under GDPR, regardless of the fact that the user published it publicly themselves. Public availability doesn’t remove data from GDPR’s scope — it only changes the context in which a page admin can legally process it.

A Facebook page admin (i.e. the organisation running the page) is, in practice, a joint controller for a certain scope of data alongside Meta, per the CJEU’s Wirtschaftsakademie Schleswig-Holstein ruling. The page admin is responsible for what happens with the comments visible under their posts.

Can you delete someone’s comment without their consent?

Yes, and you don’t need the author’s consent to do it — deleting a comment isn’t processing that requires a separate legal basis toward the author, it’s an exercise of the page admin’s legitimate interest (GDPR Art. 6(1)(f)) in maintaining order and safety in a space they’re responsible for.

It’s still worth documenting that basis: a short, publicly available commenting policy (e.g. in the page’s “About” section) clearly shows on what basis and by what criteria comments get removed. That’s not a strict GDPR requirement, but it makes it much easier to demonstrate, in the event of a dispute or complaint, that decisions aren’t arbitrary.

What data does an automated moderation tool actually process?

A tool like ZenFeed processes the comment text plus basic metadata publicly available via the Facebook Graph API — the author’s ID, profile name, and timestamp. That isn’t sensitive data under GDPR Art. 9 (e.g. health data, sexual orientation, or political views) by itself, but the comment’s content can indirectly reveal such data (someone might write openly about their health in a comment, for instance).

That’s why a good moderation tool should have a clear policy for purging that kind of data after processing, rather than storing it indefinitely “just in case”. Retention limited to what’s strictly necessary is one of GDPR’s core principles (Art. 5(1)(e)) — minimisation and storage limitation. At ZenFeed, raw comment text is automatically deleted after 30 days — we only retain anonymised statistics beyond that (counts, toxicity category breakdowns, estimated time saved) needed for dashboard reporting. Custom retention periods are available on the Pro plan.

Do you need a Data Processing Agreement (DPA) with your moderation vendor?

Yes — since ZenFeed processes commenters’ personal data on your behalf (and comment moderation does exactly that), we’re a processor under GDPR Art. 28. You don’t need to ask us for one or sign anything separately: our Data Processing Agreement (DPA) is an integral addendum to the ZenFeed.eu Terms of Service and takes effect automatically when you create an account.

Server location matters here in practice — and not just the database, but the AI model doing the analysis too: processing EU citizens’ data outside the EEA requires additional transfer mechanisms (e.g. standard contractual clauses). For us, the entire chain — hosting and AI model alike — runs in the EU, which simplifies that part of the conversation with your legal team or DPO.

What about the right to be forgotten in this context?

The right to erasure (GDPR Art. 17) primarily concerns the relationship between a controller and the data subject — not content that person published themselves, publicly, on someone else’s page. In practice, if someone requests their comment be deleted, the simplest answer is usually just to delete it — this rarely creates a real conflict, since the admin’s interest (keeping the page in order) and the author’s request (removing the content) point the same direction.

A more complex situation arises with data processed “behind the scenes” by the moderation tool itself (e.g. AI analysis logs) — there, the tool’s vendor is responsible as processor, under the terms of the Data Processing Agreement. ZenFeed also responds to data deletion requests raised by Meta itself, when such a request concerns a user of our service.

Checklist before turning on automated moderation

Before you turn on automated comment moderation, here’s exactly where we stand:

• Data Processing Agreement (DPA) — we have one. It’s an integral addendum to the ZenFeed.eu Terms of Service, the full text is at /dpa, and it takes effect automatically when you create an account — nothing to sign separately.
• Server location — hosting (Hetzner) and the AI model performing the analysis (Google Vertex AI, europe-west4) run entirely within the EU.
• Retention policy — we automatically delete raw comment text after 30 days; beyond that we only keep anonymised statistics needed for dashboard reporting.
• Your own commenting policy — this one’s on you: a short, publicly visible commenting policy on your Page gives you a basis for moderation, and it’s worth having regardless of which tool you use.

See the NGO programme page and our FAQ for more details.