Which social media platforms can employers screen?
No UK law lists the platforms an employer may or may not look at. What decides whether a look is reasonable is the kind of information and why it is there, not the name of the site. Our main page on social media screening sets out when the Information Commission (ICO) says a check is justified at all; this guide works through each type of site.
Acas, which advises employers in England, Scotland and Wales, draws its line by purpose: information on jobs and business and employment social networking sites can usually be used, and personal profiles should be avoided.
Our view: the working test for any site is this: is the information public, why did the person put it there, is it relevant to a risk you have written down for this role, and will you check the same sources for every candidate at the same stage.
Why the rules follow the information, not the platform
Data protection law applies to personal data wherever you find it. The ICO says you must identify a lawful basis to collect and use information for recruitment, and should carefully consider whether it is fair to get information about candidates from other sources. In most circumstances, it says, it is only appropriate to vet the candidate who is offered the job.
The ICO says its vetting guidance is under review because of changes made by the Data (Use and Access) Act 2025. Our main page on social media screening sets out the core rules; this guide applies them to each kind of site.
Platform types at a glance
Use this once you have decided the role justifies an online check at all. Brand names change; the type of information does not.
| Type of platform | Usually reasonable | Official source it draws on |
|---|---|---|
| Professional networking sites, such as LinkedIn | Checking the work history the candidate has given you | Acas: you can use information from a business and employment social networking site, in a way that does not discriminate |
| Jobs websites and online CVs the candidate posted | Using the information as part of their application | Acas: you can usually use information someone puts on a jobs website |
| Personal social networks | Nothing, unless you have documented a specific risk for the role, told candidates and kept the reviewer apart from the decision | Acas: avoid personal profiles; ICO: justify and document a specific risk |
| Video and photo sharing sites | As for personal social networks, with extra care over images | ICO: inferring special category details is still processing special category data |
| Forums, comment sections and pseudonymous accounts | Only where you can tie the account to the candidate with confidence and it is relevant to the documented risk | ICO: online information may be out of date, or about another person with the same name |
| The candidate's own published work, such as articles, portfolios or a blog | Reviewing work the candidate has pointed you to as evidence of skills | ICO: for most roles, shortlist on the information candidates provide; deliberately publishing special category information does not make it fair or lawful to use |
| Private accounts, closed groups and messaging apps | Not reviewed | ICO: intrusive or targeted checks, such as specialist software used to see information that is not publicly available, are unlikely to be lawful, appropriate or necessary |
Professional networking and jobs sites
Acas says users of these sites will be aware that their purpose is to show their work experience and professionalism. Our view: that makes them the least contentious source. Use them for that: comparing job titles, dates and employers with the CV.
If the profile and the CV disagree, the ICO says you cannot assume the candidate is being untruthful and should give them an opportunity to explain; our CV verification page covers the process. Our view: a missing or sparse profile is not a negative. Many good candidates have no reason to keep one.
Personal profiles, photos and video
Acas warns you might be breaking the law if the person did not agree to that use of their personal profile, or if you looked at some applicants' profiles but not others. The ICO's example of how such a check might be run is a charity recruiting for a public-facing role. It told candidates public social media checks would be used and asked them about their social media use at interview, but the ICO says the charity must still decide whether, on balance, the checks are necessary and proportionate.
Images carry a particular risk. The ICO says that where you infer a candidate's race or ethnic background, you are processing special category information whether your inference is correct or not, and that if you are likely to capture such information incidentally you should identify a condition to cover it. Our view: a reviewer scrolling through holiday pictures will almost always capture something of this kind.
Forums, comments and the candidate's own writing
Forum posts and comment threads are where mistaken identity is most likely. In its example of a political party that finds blogs, videos and conversation threads about a candidate, the ICO says the information may be out of date or inaccurate, and the party might have mistaken the candidate for another person with the same name. Our guide to false positives covers confirming identity.
Work the candidate offers you is different. If an application links to a portfolio or published articles, reviewing them is part of assessing the application, and the ICO says that for most roles it will usually be appropriate to shortlist on the information candidates provide. Writing you find yourself needs more care: in the ICO's example a retailer finds a candidate's public blog about living with a disability, and using it to decide suitability would be unfair.
Private content is off limits
The ICO's example of an intrusive or targeted check is specialist software used to check information that is not publicly available. It also says you must not mislead a person or organisation, either recklessly or deliberately, into giving you information about a candidate for recruitment purposes, as this is a criminal offence.
Our view: connection requests from invented or borrowed profiles, asking a colleague connected to the candidate to look for you, and asking candidates for log-in details all reach information the candidate has not made public, and none is likely to be fair or proportionate. If a member of the public could not see it, leave it alone.
Same sources, same stage, every candidate
Acas recommends a consistent decision-making process, such as a scoring system. The ICO says you do not need a separate legitimate interests assessment for each candidate as long as your reasons for processing are the same and the information is broadly similar.
Our view: write down which platform types you will check before the campaign opens, and check those for every candidate at the same stage. If the check is only justified for the person you intend to appoint, do it then and for that person only. If a reviewer strays onto a platform type not on the list, record it and pass nothing from it to the decision makers.
Sources
- Pre-employment vetting of candidates · ICO
- Data protection and recruitment · ICO
- Shortlisting, testing, and interviewing candidates · ICO
- Choosing who to interview · Acas
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
Questions
Something else? Ask us.
Can we look at a candidate's LinkedIn profile without telling them?
Acas says you can use information from business networking sites such as LinkedIn. Tell candidates anyway in your recruitment privacy information: the ICO says that in general you should not use information in ways the candidate would not reasonably expect or which you have not told them about.
Can we ask a candidate to show us a private account at interview?
Our view is no. The ICO says it is unlikely to be lawful, appropriate or necessary to conduct intrusive or targeted checks of candidates on social media or online, giving the example of specialist software used to check information that is not publicly available. A candidate asked at interview is unlikely to feel free to refuse.
Is a candidate with no social media presence a concern?
Our view: no. An absence of profiles tells you nothing about suitability and should not be scored. The ICO says that for most roles it will usually be appropriate to shortlist on the information candidates provide rather than on information from other sources, such as public social media profiles.
Do the same rules apply to video and photo sharing sites?
Yes. The rules attach to the information, not the site. Images make special category information easier to see or infer, and the ICO says an inference about race or ethnic background is special category processing whether or not it is correct.
Related checks
- Social media checks on job candidates When a UK employer can review a candidate's public social media, what to tell them, who should look, and what to do with what you find.
- CV verification: checking employment history and handling discrepancies How to verify a candidate's CV and employment history fairly: gaps, HMRC records, discrepancies, the Fraud Act and what to record.
- Adverse media checks on job candidates When a UK employer can search the press and online sources for negative coverage of a candidate, and how to handle namesakes and allegations.
Guides
- What can social media screening legitimately flag? Which social media findings can fairly reach a UK hiring decision, which must be filtered out, and an illustrative criteria list to adapt.
- Protected characteristics and social media screening: avoiding bias Why social media checks expose protected characteristics, how to keep them out of hiring decisions, and a human-review checklist for UK employers.
- False positives in online background checks: name matching and context How UK employers avoid acting on the wrong person or a misread post in online checks: namesakes, old posts, fake accounts, tags and context.
- Manual search or social media screening software? How a documented manual search compares with a specialist social media screening service on records, accuracy, privacy, automated decisions and contracts.
- How to write a candidate screening privacy notice What UK GDPR Articles 13 and 14 and the ICO say candidates must be told about background checks, when to tell them, and example wording to adapt.
Related answers
- What should employers consider when using AI in recruitment? Employers remain responsible under data protection and equality law when they use AI to source, screen or score candidates. The ICO expects a data protection impact assessment, a lawful basis, clear contracts with the provider, checks for bias, transparency with candidates and minimal data collection. Employers should also plan reasonable adjustments for disabled applicants.
- Can employers monitor their staff? Yes, but the ICO says monitoring must be lawful, fair and transparent under data protection law. Employers need a clear purpose, a lawful basis, the least intrusive method that achieves it, and must tell workers about it. A data protection impact assessment is required for high-risk monitoring, and covert monitoring is justified only in exceptional circumstances.