Twitter under formal investigation for how it tracks users in GDPR Era  

Twitter is being investigated by Irish privacy authorities over its refusal to give a user information about how it tracks him when he clicks on links in tweets.

When Twitter (TWTR, +0.82%) users put links into tweets, the service applies its own link-shortening service, t.co, to them. Twitter says this allows the platform to measure how many times a link has been clicked, and helps it to fight the spread of malware through dodgy links.

However, privacy researcher Michael Veale, who works at University College London, suspects that Twitter gets more information when people click on t.co links, and that it might use them to track those people as they surf the web, by leaving cookies in their browsers.

As is his right under the new General Data Protection Regulation (GDPR)—the sweeping set of privacy rules that came into effect across the EU in May—Veale asked Twitter to give him all the personal data it holds on him.

The company refused to hand over the data it recorded when Veale clicked on links in other people’s tweets, claiming that providing this information would take a disproportionate effort. So, in August, Veale complained to the Irish Data Protection Commission (DPC), which on Thursday told him it was opening an investigation. As is common with big tech firms, Twitter’s European operations are headquartered in Dublin, which is why Veale complained in Ireland.

“The DPC has initiated a formal statutory inquiry in respect of your complaint,” the watchdog said in a letter to Veale. “The inquiry will examine whether or not Twitter has discharged its obligations in connection with the subject matter of your complaint and determine whether or not any provisions of the GDPR or the [Irish Data Protection] Act have been contravened by Twitter in this respect.”

The regulator also said the complaint was likely to be handled by the new European Data Protection Board—a body that helps national data protection authorities coordinate their GDPR enforcement efforts—as Veale’s complaint “involves cross-border processing.”

When Twitter told Veale that it would not hand over the data it held on his tracking via t.co links, it claimed the GDPR allowed it to do so on “disproportionate effort” grounds. However, Veale said Twitter was misinterpreting the text of the law, and that this exemption cannot be used to limit so-called access requests, such as the one he made.

This appears to be the first GDPR investigation to be opened in relation to Twitter. Veale recently prompted a similar probe into Facebook, again over a refusal to hand over data held on users’ web-browsing activities, but Facebook(FB, +2.98%) was already the subject of multiple GDPR investigations.