The article considers the principal concerns posed by the increasing influence of social media and analyses the potential and actual legal bases relied upon by selected platforms for the processing of personal data. Special reference is made to the EU General Data Protection Regulation (Regulation (EU) 2016/679). The article concludes that the application of those legal bases may be questionable in certain situations and that platforms may struggle to achieve the transparency and proportionality required by applicable rules.