After researcher complains that Twitter refused to provide info about how it tracks him when he clicks on links in tweets, EU initiates GDPR compliance inquiry
David Meyer / Fortune :
Context & Ripple Effects
This inquiry lands months after the GDPR granted standardized data-protection rights across 28 countries, and it is an early test of one of those rights in practice: a researcher invoked his access rights and Twitter refused to explain how it tracks him when he clicks links in tweets, prompting EU regulators to open a compliance probe.
It also arrives just days after research showed ad trackers per page fell for EU users post-GDPR while rising for US users, so regulators are probing link-click tracking at the exact moment the measurement ecosystem is visibly diverging by jurisdiction.
First-order effects
- Twitter must now answer EU regulators on what data it collects from link clicks and why it denied the researcher's access request, with its Irish lead regulator positioned to run the file.
- The researcher's complaint establishes a working template: individual access requests can escalate into formal inquiries when a platform stonewalls.
Second-order effects
- Other platforms running similar link-shortening and click-tracking systems face the same access-request exposure, since a finding against Twitter would set the standard they are measured against.
- Regulators' willingness to pursue this case shapes their bandwidth for the bigger files already queued against US platforms, echoing the earlier German investigation of EU-to-US data transfers by companies like Facebook and Google.
Third-order effects
- If access rights keep being enforced through complaint-driven inquiries, click-tracking becomes a standing legal liability for ad-funded platforms, pushing disclosure and minimization into how link analytics are built rather than bolted on afterward.
- The pattern that later produced regulators clashing over how much to fine Twitter suggests fragmented national authorities will remain the bottleneck, keeping outcomes dependent on which regulator leads each file.
The trend: GDPR enforcement is shifting from abstract compliance deadlines toward complaint-driven probes of specific tracking practices, with link-click data an early battleground.