Library user privacy under GDPR: authentication, proxy logs, discovery and analytics

An academic library knows what its users borrow, search for and read. That makes library data some of the most sensitive data a university holds, even when it looks like ordinary system logs. This guide explains what personal data a library processes, which legal bases apply, how proxy and federated login work from a privacy point of view, what publishers and vendors can see, and how long real European university libraries keep their logs.

Published 9 October 2026 · Sources checked 9 October 2026

Also available in: Svenska · Nederlands · Norsk · Suomi · Dansk · Français · Español · Português

1. What personal data does an academic library process?

An academic library processes identity and account data for every registered user, transaction data about loans, requests and fees, and log data from the systems that give access to electronic resources. Together these show who read what and when. Add room booking, chat, CCTV and AI search tools, and a library can hold a detailed picture of each user's intellectual life.

The main categories are:

• Patron record. Name, university ID, email, user group (student, staff, external), card number, sometimes national identity number. Linköping University Library, for example, lists name, personal identity number, email and LiU-ID in its borrower register.
• Loans, holds and fees. Current loans, reservations, overdue notices and fees. Whether the link to a person is kept after return is a key design choice (see section 10).
• Interlibrary loan (ILL) and document delivery. Request forms naming the requester and the title, often passed to another library or a commercial supplier.
• Reading lists. Course reading lists link teachers, courses and titles, and some systems record student clicks.
• Authentication and proxy logs. IP address, username or session ID, time and the URL of the article or database. These logs are the most direct record of what a person read.
• Discovery search logs. Search terms, saved searches, favourites and click data in the library catalogue or discovery layer.
• Room and equipment booking. Who booked which room and when, often in a third-party booking service.
• Chat and email reference. Free-text questions that can reveal research topics and personal circumstances.
• CCTV and door access. Images and entry records for library buildings.
• Web and usage analytics. Website analytics, publisher usage statistics and library analytics dashboards.
• AI search assistants. Questions typed into tools such as Primo Research Assistant or Scopus AI, and the conversation history.

IP addresses and session identifiers count. Recital 30 GDPR explains that people "may be associated with online identifiers provided by their devices", naming internet protocol addresses and cookie identifiers, and that these traces can be used to create profiles. A proxy log is therefore personal data even if it does not contain a name.

2. Which legal bases apply to library processing?

For a public university, the usual legal basis for core library services is public task under Article 6(1)(e) GDPR, sometimes combined with contract (Article 6(1)(b)) for loans and legal obligation (Article 6(1)(c)) for accounting records. Consent belongs to optional extras. Legitimate interests is not available to public authorities for processing in the performance of their tasks.

Real notices show how this works in practice:

• Université Paris Cité states for its digital library that the legal basis is "l’exécution d’une mission d'intérêt public (article 6.1.e du RGPD)" (the performance of a task in the public interest).
• The Universidad Complutense de Madrid library lists both contract (Art. 6.1.b) and public interest (Art. 6.1.e) for its loan, reading room and interlibrary loan service, with reference to the Spanish universities act.
• Linköping University Library frames the borrower relationship as a loan agreement, which corresponds to contract.

Consent fits features a user can refuse without losing the service, such as keeping a personal reading history, saved searches with a personal account, or personalisation on a publisher platform. Because of the imbalance between a university and its students and staff, consent is a poor basis for anything the user cannot avoid.

Special category data. Article 9(1) prohibits processing data revealing, among other things, political opinions, religious beliefs, health or sexual orientation, unless an exception applies. A loan record or a proxy log is not normally processed in order to reveal those things. Validemic's analysis Even so, a reading history can reveal them by inference, which is a good reason to treat library logs as high-sensitivity data in your DPIA and security classification, and to keep them only briefly.

National confidentiality rules may add protection. In Sweden, Linköping University Library reminds users that library records are covered by secrecy under chapter 40, section 3 of the Public Access to Information and Secrecy Act (OSL). Check whether your country has a similar library secrecy provision, because it affects what the library can disclose, for example in response to a public records request.

The storage limitation principle in Article 5(1)(e) requires that personal data be "kept in a form which permits identification of data subjects for no longer than is necessary". For logs, that is the rule that matters most. Data protection by design and by default (Article 25) supports configuring systems to collect less from the start. See our GDPR overview for the text of these articles.

3. Why library privacy is an intellectual freedom issue

Library privacy is not only a compliance topic. The library profession treats confidentiality of what people read as a condition for free inquiry: if users think they are watched, they may avoid certain topics. This ethical baseline is often stricter than the GDPR minimum, and it gives libraries a strong argument in negotiations with vendors.

The IFLA Statement on Privacy in the Library Environment, endorsed by the IFLA Governing Board on 14 August 2015, warns that excessive data collection can have "a chilling effect on society". It recommends that libraries "should reject electronic surveillance and any type of illegitimate monitoring" and that they "should take measures to limit collection of personal information about their users and the services that they use." It also notes that libraries can "refuse to acquire services that collect excessive data".

"The relationship between the library and the user is one of confidentiality."

In the United States, which has no GDPR, the American Library Association sets similar expectations. ALA's interpretation of the Library Bill of Rights on privacy, last amended on 29 June 2025, states that "confidentiality is essential for free inquiry" and that libraries "should only collect and store the PII required for specific, clearly disclosed purposes." Its Library Privacy Guidelines for Vendors add that "User data should not be retained in perpetuity." These texts are a useful comparison for European libraries that buy from US vendors: the vendors know these expectations.

The NISO Consensus Principles on Users' Digital Privacy in Library, Publisher, and Software-Provider Systems (December 2015) were written jointly by libraries, publishers and software providers. They aim at "balancing the expectations library users have regarding their intellectual freedoms and their privacy", with principles on data collection and use, anonymisation, sharing data with others and supporting anonymous use. The Library Freedom Project, which describes itself as "a network of values-driven librarians working together to build information democracy", trains librarians in practical privacy work.

4. Proxy logs: what do EZproxy and OpenAthens record?

A proxy server such as OCLC's EZproxy sits between the user and the publisher, so its logs record every request: IP address, time, URL and, if configured, the username. OpenAthens instead acts as an identity provider and passes attributes to publishers. In both cases the library decides much of what is logged, released and kept, so configuration is a data protection decision.

EZproxy

OCLC's documentation lists four log types. The main ezproxy.log records traffic between EZproxy and content providers, including the user's IP address, request time, requested URL, HTTP status and bytes transferred. The default format is %h %l %u %t "%r" %s %b, where %u is the "Username used to log into EZproxy if Option LogUser appears in config.txt". Audit logs record logins, failed logins and blocked access. An optional SPU log records each click on a starting point URL.

Points to check in your configuration:

• Usernames in logs. Without Option LogUser, the main log holds IP and session data rather than usernames. Decide whether you need usernames for abuse investigations, and if so for how long.
• Audit log retention. OCLC says the AuditPurge directive defaults to 7 days, and also that "OCLC suggests increasing the AuditPurge time period to 180". That is a security suggestion, not a legal requirement. Set a period your DPO can justify.
• Hosted EZproxy. For OCLC-hosted EZproxy, the audit log is retained for 180 days and "The default retention period for all other logs is set to 400 days." OCLC adds that "The minimum log retention period can be adjusted to 180 days, while the maximum is 1830 days." Hosted customers who want less than 180 days should raise it with OCLC in writing.
• EZproxy Analytics. OCLC notes that "the data may contain usernames and/or IP addresses", and that log files are replicated to an AWS-hosted analytics instance in the same region. If you enable it, record it as a processing activity and check the DPA covers it.
• Pseudonymous identifiers. EZproxy 7.1 "introduced an optional feature that releases pseudonymous identifiers to content providers", so that publishers can report misuse by a pseudonym instead of the library releasing who the user is.

Real libraries publish what they log. The University of Oslo Library lists the IP address, the resource URL, date and time, HTTP details, the EZproxy session ID and the "Username of your account at UiO", and says it "stores the following data about your web traffic for 6 months before it is deleted", in line with the university's general rules for system and security logging.

OpenAthens

OpenAthens states that it "acts as a data processor for customers who subscribe to the service", so the university is the controller and needs an Article 28 agreement with OpenAthens. Its documentation says that by default a Targeted ID is released to all service providers, described as "A pseudonymous user identifier generated by the system", with a different value for each service. Targeted ID is being replaced by the pairwise-id attribute, which OpenAthens says is "Only released by default for domains created after November 2023". Libraries can override the release policy per publisher, which is where name and email sometimes start flowing for personalisation features. The OpenAthens privacy page gives only a general retention statement, so ask for the retention of audit and usage logs in writing.

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

5. Federated login: what should a library release to publishers?

With federated login, the university's identity provider sends attributes to the publisher in a SAML assertion. The library and IT can decide which attributes each publisher receives. For licensed content the privacy-friendly default is a scoped affiliation and, only if needed, a pseudonymous pairwise identifier. Releasing a stable username or email lets the publisher link activity to a named person.

eduGAIN, SeamlessAccess and the entity categories

National research and education federations (for example Feide in Norway, used by Nord University for EZproxy login, and the UK Access Management Federation) connect to each other through eduGAIN. The eduGAIN site describes how it lets federations "interconnect, so that participating institutions and services can collaborate without the need to establish individual bilateral connections." On 9 October 2026 its live statistics showed 84 federations.

SeamlessAccess is the "Access through your institution" button on many publisher sites. It is run by a coalition of GÉANT, Internet2, NISO and STM. Its privacy page says it "runs its software locally in your browser and stores this information in browser local storage", namely the last institutions you chose, and that no name or email is stored. The button helps the user find their login; attribute release is still decided by the identity provider.

REFEDS entity categories give a shared vocabulary for attribute release:

The REFEDS Data Protection Code of Conduct (v2, 28 March 2022) is a separate category for service providers that commit to GDPR-based rules before receiving attributes. It is useful evidence, but it does not replace your own review.

Pairwise-id versus eduPersonPrincipalName

eduPersonPrincipalName (ePPN) looks like an email address and is the same at every service, so two publishers that both receive it can correlate a user's activity. eduPersonTargetedID and its successor pairwise-id give each service a different value for the same person. The UK Access Management Federation considers that there is "very little personally identifying information carried by either eduPersonScopedAffiliation or eduPersonTargetedID" and therefore safe to release to any service, but adds that "your organisation should do its own risk analysis in consultation with its data protection officer".

Validemic's analysis A sensible default for publishers is: scoped affiliation for everyone, pairwise-id only for services that offer personal features, and name or email only after a documented request from the publisher and a decision by the library and DPO. Review release policies yearly, because exceptions granted for one feature tend to stay.

6. What can publishers see? Third-party tracking on platforms

Even with minimal attributes, publisher websites can collect data through cookies, scripts and fingerprinting. Studies have found advertising and analytics trackers on major academic platforms. The library usually cannot control a publisher's website directly, so the licence, the DPA and clear user information are the main tools.

Cody Hanson's study User Tracking on Academic Publisher Platforms (2019) examined article pages on 15 publisher platforms. He found Google code on 14 of them and Google's DoubleClick ad network on 13, with pages loading an average of 18 third-party assets from 139 distinct sources. He concluded that library privacy statements "do not accurately represent the current state of patron privacy in use of licensed resources", and that "publishers don’t need RA21 or even what we typically think of as PII to identify library users."

In 2021 the German Research Foundation's Committee on Scientific Library Services and Information Systems (DFG AWBI) published the briefing paper Data tracking in research: aggregation and use or sale of usage data by academic publishers. It describes microtargeting, bidstream data and proposed "spyware" for libraries, and warns that such tracking "can fundamentally contradict academic freedom and informational self-determination". The DFG reports that its recommendations led to "a separate section on data protection and data tracking" in the German DEAL agreements with major publishers. That is a model other consortia can use.

SPARC, the US-based coalition for open scholarship, wrote in April 2021 that two major library vendors "have been building sophisticated, global systems of surveillance", and urged libraries to consider "a renewed focus on contractual terms (particularly privacy clauses)". These are advocacy positions; read them as reasons to ask questions, not as findings about any specific contract.

What a library can do:

1. Ask each platform for a list of third-party scripts and cookies on content pages, and whether any are used for advertising.
2. Put a data protection and tracking clause in the licence or consortium agreement, as the DEAL agreements did. See our guide on library licences, AI and text and data mining for licence clauses.
3. Check whether the publisher acts as controller or processor for usage data. For most licensed platforms, the publisher is a controller for its own website, so an Article 28 agreement is not the right instrument; data protection terms in the licence are.
4. Tell users plainly that publisher sites have their own privacy policies and cookies, as the IFLA statement recommends.

7. Discovery search logs and AI research assistants

Search logs in a discovery system record what people look for, which can be more revealing than what they borrow. AI research assistants add a new layer: free-text questions and conversation history, processed by a language model provider. Ask vendors separately what the vendor logs and what the model provider keeps.

Short retention is possible. Erfurt University Library's privacy policy for its Discovery search portal says server log data "is deleted regularly (after a period of 5 days)", and that the link resolver provider keeps IP addresses in its web server logs for 7 days. Saved favourites and search history are kept for one year after the user's last login.

For AI assistants, vendors describe their practices differently:

• Primo Research Assistant (Ex Libris, part of Clarivate). The Knowledge Center says "Clarivate does not use your data to directly or indirectly train LLMs" and "Neither your input nor the licensed content are stored by the LLM". It does not name the model provider or say how long Clarivate itself keeps queries. Ask for both.
• Scopus AI (Elsevier). Elsevier's product page says standard conversations are "Stored indefinitely until your contract ends or customer/user request deletion", while temporary conversations are "Held for up to 30 days only." It says there is an agreement that no user queries will be stored or used to train ChatGPT. Our Scopus AI fact sheet sets out the rest of Elsevier's documentation.

Validemic's analysis Prompt logs are a new kind of library record. A question such as "studies on treatment of my condition" reveals more than a search string. Treat prompt logs like search logs: short retention, no use for training, access limited to support staff, and clear information to users. Tell users not to paste personal data about research participants into these tools. Our guide GDPR and AI tools in research covers this in more detail.

8. Library management systems and vendor DPAs

The library management system holds the patron register and all transactions, and most are now hosted by the vendor. The vendor is then a processor and the university needs an Article 28 agreement, a subprocessor list and clear anonymisation settings. Open source systems hosted by a support company need the same agreement with the hosting company.

Alma's FAQ also notes that it "conforms to FERPA guidelines", a US law. That is not a GDPR statement, so rely on the signed DPA for European obligations. For reviewing the agreement itself, our DPA checker maps it against Article 28(3), and the vendor questionnaire builder helps you ask library vendors the right questions. The general process is in our vendor assessment guide.

9. Library analytics and learning analytics

Libraries increasingly combine loans, e-resource use and space use for collection decisions, and some universities link library use to student success. Aggregated statistics raise few issues. Linking identifiable library use to individual students' results is profiling and needs a clear purpose, a legal basis and usually a DPIA.

The University of Reading Library shows a common pattern: personal data is deleted after membership ends, while "Transaction data for Students are anonymised and kept indefinitely." Koha's pseudonymised statistics and Alma's anonymisation jobs support the same approach. Check that anonymisation is real: a loan record with the patron removed but with a rare department, date and title can still point to one person.

If the library contributes data to a learning analytics programme, the rules in our learning analytics and GDPR guide apply: purpose limitation, transparency, the right to object under public task, and the AI Act rules for AI that evaluates learning outcomes, which apply from 2 December 2027. Validemic's analysis Reading data is a sensitive input for analytics because it reflects what students are curious about, not only how they perform. Many libraries will choose to contribute only aggregated data.

10. How long do real university libraries keep library data?

Published privacy notices from European university libraries show short periods are workable: loan links deleted on return, proxy logs kept from 90 days to six months, chat and CCTV deleted after about 30 days. The table below quotes notices read on 9 October 2026. Periods are each institution's own choice, not legal requirements.

Two patterns stand out. First, deleting the person-to-loan link on return is common across countries, and it rarely causes practical problems because overdue and fee records are kept until they are settled. Second, the spread for ILL records (30 days at Southern Denmark, two years at Åbo Akademi, seven years at Reading) shows that some libraries tie ILL to financial or contractual records. If you keep ILL longer, write down why. Our retention schedule guide explains how to record these decisions.

11. System by system: typical data, retention and contract points

Validemic's analysis The suggestions below are starting points based on the published practice above. Adjust them to your national law, your security policy and your own purposes, and record the reasons in your retention schedule.

12. Checklist for library and DPO

Sources

1. Regulation (EU) 2016/679 (GDPR), Articles 5, 6, 9, 25, 28 and Recital 30 (retrieved 9 October 2026).
2. IFLA Statement on Privacy in the Library Environment, endorsed 14 August 2015 (retrieved 9 October 2026).
3. IFLA Code of Ethics for Librarians and other Information Workers (long version), August 2012 (retrieved 9 October 2026).
4. ALA: Privacy, an Interpretation of the Library Bill of Rights, amended 29 June 2025 (retrieved 9 October 2026).
5. ALA: Library Privacy Guidelines for Vendors, revised 26 January 2020 (retrieved 9 October 2026).
6. NISO Consensus Principles on Users' Digital Privacy in Library, Publisher, and Software-Provider Systems, 10 December 2015 (retrieved 9 October 2026).
7. Library Freedom Project (retrieved 9 October 2026).
8. OCLC: EZproxy log files overview and LogFormat directive (retrieved 9 October 2026).
9. OCLC: How long are the logs kept for Hosted EZproxy (retrieved 9 October 2026).
10. OCLC: EZproxy Analytics privacy considerations (retrieved 9 October 2026).
11. OCLC: EZproxy pseudonymous identifier administration (retrieved 9 October 2026).
12. OpenAthens: Privacy and About released attributes (retrieved 9 October 2026).
13. SeamlessAccess: Privacy and Trust and About (retrieved 9 October 2026).
14. eduGAIN: What is eduGAIN (retrieved 9 October 2026).
15. REFEDS entity categories: Anonymous Access, Pseudonymous Access, Personalized Access, Research and Scholarship and Data Protection Code of Conduct v2 (retrieved 9 October 2026).
16. UK Access Management Federation: attribute release (retrieved 9 October 2026).
17. Cody Hanson, User Tracking on Academic Publisher Platforms, 2019 (retrieved 9 October 2026).
18. DFG: Data tracking in research and the AWBI briefing paper (English), 2021 (retrieved 9 October 2026).
19. SPARC: Addressing the Alarming Systems of Surveillance Built By Library Vendors, 9 April 2021 (retrieved 9 October 2026).
20. Ex Libris: GDPR and Alma FAQ: Security and Privacy (retrieved 9 October 2026).
21. Ex Libris Knowledge Center: Primo Research Assistant (retrieved 9 October 2026).
22. Elsevier: Scopus AI product page (retrieved 9 October 2026).
23. FOLIO documentation: Settings, Circulation (retrieved 9 October 2026).
24. OCLC: GDPR, partnering with customers (retrieved 9 October 2026).
25. Koha manual: cron jobs (retrieved 9 October 2026).
26. University of Oslo Library: privacy policy (retrieved 9 October 2026).
27. Nord University: Privacy notices for the University Library (retrieved 9 October 2026).
28. UiT The Arctic University of Norway: The University Library's Privacy Policy (retrieved 9 October 2026).
29. University of Bergen: Privacy at the library (retrieved 9 October 2026).
30. Radboud University: University Library Privacy Statement (retrieved 9 October 2026).
31. University Library of Southern Denmark: Policy for protection of personal data (retrieved 9 October 2026).
32. Linköping University Library: Bibliotekets låneregler (retrieved 9 October 2026).
33. University of Music Würzburg: Library data protection declaration (retrieved 9 October 2026).
34. Erfurt University Library: Privacy policy, search portal Discovery (retrieved 9 October 2026).
35. Université Paris Cité: Données personnelles, gestion de la bibliothèque numérique (retrieved 9 October 2026).
36. Universidad Complutense de Madrid: processing record, Biblioteca (BUC) (retrieved 9 October 2026).
37. Åbo Akademi University: Interlibrary Loan Requests privacy notice (retrieved 9 October 2026).
38. Arcada: Library register of borrowers (retrieved 9 October 2026).
39. University of Reading Library: Data retention policy (retrieved 9 October 2026).
40. Wolfson College, Cambridge: Data Privacy Notice for Library Users (retrieved 9 October 2026).

About this page

Sources checked on 9 October 2026. We read each university library notice, vendor document and professional statement listed above on that date, and quote only short excerpts in their original wording, with English translations in brackets where needed. Retention periods are those published by each institution and may change; they are examples, not legal requirements. Where we give our own interpretation, including the retention suggestions in section 11, it is labelled as Validemic's analysis. Vendor descriptions summarise public documentation and are not statements that any product is or is not GDPR compliant, which depends on your contract, configuration and use. This page is general information, not legal advice. If you spot an error, or your library publishes retention periods you would like us to include, please contact us and we will correct or add it.