1This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. 2Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. 3However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.
Title is an unofficial description, added for readability.
The household exemption in one paragraph
No, while it stays purely private. GDPR Recital 18 explains that the Regulation doesn’t cover an individual’s processing for purely personal or household purposes with no professional or commercial link. Courts read “purely” narrowly: publishing to an open audience or filming public space brings GDPR back. The platforms and services people use are always covered.
Recital 18 explains the exclusion in Article 2(2)(c) GDPR, which is the binding rule. It gives everyday examples, such as letters and messages, an address book and social networking, so people aren’t treated as data controllers for ordinary private life.
What “purely” means: the tests courts apply
Most of the case law was decided under the old Data Protection Directive, whose Article 3(2) excluded processing “by a natural person in the course of a purely personal or household activity”, the same words now in Article 2(2)(c) GDPR (Lindqvist, para. 4). The EDPB applies that case law under GDPR in its video-device guidelines. Read together, the rulings give four tests:
| Test | What it means, and where it comes from |
|---|---|
| No professional or commercial link | Written into the first sentence of Recital 18 itself. |
| Private or family life only | The exemption covers only activities in the course of private or family life (Lindqvist, para. 47; Jehovan todistajat, para. 42). |
| Not open to an unrestricted audience | Making data accessible to an indefinite number of people ends the exemption (Lindqvist, para. 47; Buivids, para. 43). |
| Not directed outwards into public space | An activity that reaches, even partly, into public space isn’t purely personal (Jehovan todistajat, para. 42). |
One more point from the case law: “personal or household” describes the activity of the person doing the processing, not the person whose data it is (Jehovan todistajat, para. 41).
Why social networking is listed, and why it still goes wrong
The old Directive’s recital gave only correspondence and address records as examples (quoted in Jehovan todistajat, para. 3). Recital 18 adds social networking and online activity, but only “within the context of such activities”. The activity still has to be purely personal. That’s why a Dutch court in 2020 applied GDPR to a grandmother’s Facebook posts when it wasn’t shown her profile was shielded (Gelderland case study).
The exemption protects the person, not the platform
The third sentence of Recital 18 closes an obvious gap. A messaging app, social network, photo-sharing site or cloud camera service that processes users’ data is a controller or processor in its own right (definitions in Art. 4 GDPR), so GDPR applies to it in full even when each user is exempt. Organising other people’s data collection can have the same effect: in Jehovan todistajat, a religious community that coordinated its members’ door-to-door visits was a joint controller under what is now Art. 26 GDPR, without ever holding the notes.
What this means in practice
Yes to bothThe household exemption is likely to apply, so GDPR doesn’t govern this processing
No to eitherGDPR applies, and you may be a controller with its duties
If you’re an individualOrdinary private life is out of scope. The risk starts when data leave your private circle:
- Private messages, an address book, and photos shared with a closed family group match the recital’s own examples.
- Public posts or open profiles can end the exemption (Buivids, Gelderland).
- A home camera that covers the street or a neighbour’s property brings GDPR in (Ryneš; EDPB).
If you run a platform, app or serviceYour users’ exemption never covers your own processing:
How courts have drawn the line: five cases
Recital 18 has been tested in four EU Court of Justice judgments and in national courts. In every case below, the activity looked private to the person doing it, but failed at least one of the tests above. Selected decisions:
| Case | Court | Date | Outcome | Why the exemption failed |
|---|---|---|---|---|
| Lindqvist (C-101/01) | CJEU (full court) | Nov 2003 | Exemption refused; fine of SEK 4.000 at first instance | Published online to an indefinite audience |
| Ryneš (C-212/13) | CJEU (Fourth Chamber) | Dec 2014 | Exemption refused; case returned to the Czech court | Camera covered a public footpath |
| Jehovan todistajat (C-25/17) | CJEU (Grand Chamber) | Jul 2018 | Exemption refused; community held a joint controller | Activity directed outwards to strangers |
| Buivids (C-345/17) | CJEU (Second Chamber) | Feb 2019 | Exemption refused; journalism question sent back | Video uploaded without restricting access |
| Rb. Gelderland (13 May 2020) | Rechtbank Gelderland | May 2020 | GDPR applied; removal ordered, penalty up to €1.000 | Profile not shown to be shielded |
All Recital 18 enforcement cases
Frequently asked questions
Does GDPR apply to my personal contacts, messages and family photos?
Usually not. Recital 18 names correspondence and the holding of addresses as examples of personal or household activity, and GDPR doesn’t apply to that processing while it stays purely private and has no professional or commercial link. Courts read the exemption narrowly, so it stops applying once the data are opened up to an unrestricted audience.
Is posting on social media covered by the household exemption?
Only while it stays within a genuinely personal circle. Recital 18 lists social networking as a possible household activity, but the EU Court of Justice has held that publishing personal data so they are accessible to an indefinite number of people is not purely personal. A Dutch court applied that reasoning in 2020 to a grandmother’s Facebook photos of her grandchildren.
Does GDPR apply to a home security camera or video doorbell?
It can. In Ryneš (C-212/13), the EU Court of Justice held that a home camera covering a public footpath, even partially, is not a purely personal or household activity. The EDPB says the same applies where a continuously recording home camera covers the street or a neighbour’s property.
Can a social network or messaging app rely on its users’ household exemption?
No. The third sentence of Recital 18 says GDPR still applies to controllers or processors that provide the means for personal or household processing. The individual user may be exempt; the service provider is not.
Is Recital 18 legally binding?
Recitals are not binding in the same way as Articles, but courts and data protection authorities use them to interpret the GDPR. The binding rule is Article 2(2)(c), which excludes processing by a natural person in the course of a purely personal or household activity; Recital 18 explains what that covers.
Your users’ activity may be private. Your platform’s isn’t.
Recital 18 exempts individuals, not the services they use. If your site or app processes visitor data, consent and transparency duties apply in full. A consent management platform is one way to handle them.
Related provisions
Sources & further reading
- Regulation (EU) 2016/679 (GDPR), Recital 18 and Article 2(2)(c): official text
- CJEU, Case C-101/01 Lindqvist, judgment of 6 November 2003 (ECLI:EU:C:2003:596)
- CJEU Press Release No 175/14, Judgment in Case C-212/13 Ryneš, 11 December 2014
- CJEU Press Release No 103/18, Judgment in Case C-25/17
- CJEU, Case C-345/17 Buivids, judgment of 14 February 2019
- Rechtbank Gelderland, 13 May 2020, ECLI:NL:RBGEL:2020:2521 (Dutch)
- EDPB, Guidelines 3/2019 on processing of personal data through video devices (version 2.0)