Councils Are Buying Software That Listens to What Residents Say About Them Online. The Contract Notices Say So. The Privacy Notices Mostly Describe Something Narrower.
Estimated reading time: 9 minutes
In short. Two suppliers sell social media listening to public bodies through the government's Digital Marketplace. One says 30 per cent of local councils and 80 per cent of UK constabularies use it, and lists blogs, forums and YouTube among the sources it monitors [1]. The other says it tracks "unofficial resident-to-resident discourse" for more than 350 government and police bodies in the UK and USA [2]. Devon County Council's contract notice of January 2026 names "listening capabilities" in the first sentence [3]. A Devon cabinet member told the council in September 2024 that it monitors X without an active account there and picks up "relevant posts and intelligence" [7]. The privacy notices councils publish for residents are mostly about what happens when you contact the council, not when you talk about it. The Department for Transport's notice shows what the fuller version looks like [9].
The place to start is not a leak or a whistleblower. It is a sales listing on a government website. Suppliers who want to sell cloud software to the public sector list it on the Digital Marketplace under the G-Cloud framework, and the listings are public. SocialSignIn Ltd, trading as Orlo, describes its product there as "Social Media Listening and Monitoring", says it is "trusted by over 400 organisations, including 80% of UK constabularies, 30% of local councils, and numerous housing associations", and lists among its features coverage of "Blogs, forums, Twitter, TikTok, Nextdoor, Facebook, Google+, YouTube and more", the ability to "Respond to non-direct mentions", and the ability to "Monitor profiles, keywords, hashtags and phrases" [1]. The price on the listing is £960 to £2,400 a user, and the data is UK-hosted [1].
A second listing, from Commonplace, "powered by Zencity", describes "a community sentiment, insights and engagement platform powering the work of 350+ central/local government and police forces across UK and USA". Its stated purpose is to "Look beyond your official channels to understand resident-to-resident conversations", and its features include "Track unofficial resident-to-resident discourse alongside your official media channels" and "Filter and aggregate data by department, keyword or geography" [2]. That listing mentions YouTube only as a channel it can publish to, not as one it reads, and nothing in this piece should be taken as saying otherwise [2].
A caution that belongs in the same breath: a G-Cloud listing is a supplier's description of itself. "30% of local councils" is a marketing figure on a procurement form, not an audited count, and the listing does not say which councils, or which of them have switched the listening module on. What it does establish is what is on sale, to whom, and that the seller considers a third of councils to be customers.
The contracts
Four award notices on Contracts Finder, the government's register of public contracts, show councils buying this platform. They are worth reading closely because they do not all say the same thing.
Devon County Council published a notice on 8 January 2026 for a contract awarded on 18 December 2025 to "SocialSignin Ltd, trading as Orlo". The description begins: "A social media management platform and media monitoring intelligence tool that also has listening capabilities." The value is £12,000 for the initial year, rising to £48,000 if three annual extensions are taken [3].
The document reference. Contracts Finder notice f531bee2-5fe4-46fa-850b-c5686021fb97, Devon County Council, published 8 January 2026, awarded 18 December 2025, contract 5 January 2026 to 4 January 2027, total value £12,000, supplier SocialSignin Ltd trading as Orlo. The description's first sentence names the listening capability [3].
The other three notices describe the same supplier's product in narrower terms. Kirklees Council's notice of March 2022, for £40,200 over up to four years to February 2026, is for "Social Media Management Software" [4]. The London Borough of Merton's notice of March 2025, for £26,650 over three years to November 2027, is for "a social media management platform for the communications team to manage, schedule and evaluate our digital content" over the council's own accounts [5]. Islington Council's notice of August 2024, for £22,881.90 over two years to June 2026, says the tool is used by approximately 35 staff to schedule content, analyse output and "respond to resident queries received via social media" [6].
So the same product is bought by four councils, and one of the four says in its own notice that it is buying listening. That is the fair reading, and it cuts both ways. A council that buys a platform with a listening feature has not necessarily turned it on, and a council whose notice talks only about scheduling its own posts has not necessarily left it off. The notice records what was procured, not how it is used. Finding out how it is used is what Freedom of Information is for, and that is covered below.
What Devon said when a councillor asked
There is one document in which a council describes, in its own words, what monitoring means in practice. At Devon County Council's meeting of 5 September 2024, a councillor asked why the council had stopped using X, where it had around 52,000 followers. The cabinet member's written reply explains that the corporate X account is dormant, gives cost and abuse as the reasons, and then says: "We do monitor the platform and are able to pick up relevant posts and intelligence, such as in the case of the recent protests and claims of potential unrest in Exeter" [7].
Read that alongside the contract notice fifteen months later. A council with no active presence on a platform was nonetheless monitoring it for posts and intelligence, and the reply treats that as unremarkable. The example given, public order, is also the kind of case most people would accept. The question the documents do not answer is what else the keywords cover.
What the central government playbook says
This is not a local invention. The Government Digital Service's social media playbook, a published piece of guidance last updated in January 2023, says plainly: "Government departments use different commercial social media listening tools to monitor for specific mentions of words or phrases to learn what people are saying online." It describes social listening as "finding conversations that matter to you, but might not include your account (for example, when you are not tagged)", notes that the Cabinet Office "has a specialised Media Monitoring Unit", and advises anyone buying such a tool to talk to their data protection team "early in the procurement process" [8]. The same playbook, under community management, says "It can be helpful to record disruptive users who routinely breach community rules, so other staff know not to respond to them", and that reporting or blocking a user is "a last resort" [8].
Monitoring, recording and blocking are three different actions, and the playbook treats them as such. That distinction matters for everything that follows.
What residents are told, and what they are not
If a public body collects personal data, data protection law requires it to tell people, usually through a privacy notice. The Department for Transport's notice for social and digital media analysis, updated on 23 September 2026, is the clearest statement in this piece of what listening involves. It says the department "monitors and analyses public social media and search data using third-party tools", that "While we do not actively monitor individuals, personal data may be included in social media posts and news articles that we analyse", and that it "may collect individual posts receiving high engagement to illustrate particular discussions or narratives". Those posts "will include social media usernames (which may or may not be real names) and opinions", which "may express political opinions or philosophical beliefs". Retention is "for as long as it is required for the matter it relates to" [9].
Set that beside what councils publish. Runnymede Borough Council's social media privacy notice is more candid than most. It gives "legitimate interests" as a lawful basis, "for example, to monitor what is being posted online that could impact on the council and its residents". It says that if the council believes a resident is abusing its social media policy, "we will store their username and screenshots of relevant comments on our server, in case of further action being taken", and that where a public post suggests an offence or a breach of a council contract, "the Communications Team may view public profiles to identify the social media user and report to a relevant department" [10]. East Sussex County Council's social media policy promises that "we will monitor our social media accounts and keep a record of all posts to and from our accounts", and reserves "the right to keep a record of and remove any contributions" that break its acceptable use rules [11]. Kirklees Council's social media page says that for content breaking its rules "we will also screenshot the posts and consider legal action or sending them on to the police for investigation" [12].
Every one of those council documents is written around the council's own accounts: what happens when you message it, comment on its page or break its rules there. Runnymede's is the only one of the three that names monitoring "what is being posted online" as a purpose in its own right, and even that notice does not say what tool does the monitoring, what terms it watches for, or how long a copy of an ordinary critical post is kept. None of this is a finding against any of those councils. A privacy notice about direct contact is exactly what a council needs if direct contact is all it does. The gap is between what Devon's contract notice says was bought, what the Devon cabinet member said is done, and what residents of councils generally are told. This site checked three councils' notices for this piece, not all of them, and will not pretend to a survey it has not done.
What the documents do not show
This is the part where comment has to be labelled as comment. Nothing in any document cited here shows a council asking a platform to remove a resident's post, or a platform acting on a council's say-so. Monitoring a public conversation, keeping a copy of a post, moderating the council's own page, and asking a platform to take down someone else's comment are four different things, and only the first three appear anywhere in these documents. Anyone who finds their comments vanishing from a video or a page should look first at the platform's own moderation settings, which can hold a comment on a channel owner's word list or on automated detection, before reaching for a theory that involves a public body. If evidence of the fourth action ever appears in a council document, it will be reported here with the reference attached.
What a reader can do
Ask the council about the system, not about yourself. A Freedom of Information request can ask for the current social media monitoring contract and service specification, which platforms and sources are covered, the policy for setting search terms, the current search terms or the policy for withholding them, the retention period for captured posts, and the escalation procedure for a post flagged by the tool. Requests made through WhatDoTheyKnow are published, so the answer becomes a citable public document [13].
Ask about yourself separately. Information a council holds about you is sought through a subject access request, not FOI. The Information Commissioner's guidance says organisations usually have one month to respond, that you can ask for all the information held about you, and that some of it can lawfully be withheld [14]. A request can ask whether your handle, your posts or screenshots of them appear in any monitoring report, case file or communications record.
What this site will do. Freedom of Information requests to Devon County Council, asking the questions above about the contract awarded in December 2025, will go in through WhatDoTheyKnow and the answers will be reported here when they arrive, whatever they say. The same questions will go to a small set of other councils whose contract notices appear on Contracts Finder, so that the next piece on this subject can say what councils actually watch for, rather than what a supplier says it can watch.
Sources
- Digital Marketplace, G-Cloud 14 service listing, SocialSignIn Ltd trading as Orlo, "Social Media Listening and Monitoring" (customer claims, source coverage including YouTube, features, pricing). https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/856920625995869
- Digital Marketplace, G-Cloud 15 service listing, Commonplace (powered by Zencity), "Social Media & News Media Listening & Publishing SaaS Platform" (resident-to-resident discourse tracking, keyword filtering, 350+ bodies). https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/228303204134421
- Contracts Finder, Devon County Council, awarded contract notice published 8 January 2026, SocialSignin Ltd trading as Orlo, £12,000 (listening capabilities named in the description). https://www.contractsfinder.service.gov.uk/Notice/f531bee2-5fe4-46fa-850b-c5686021fb97
- Contracts Finder, Kirklees Council, awarded contract notice published 7 March 2022, Orlo, £40,200, Social Media Management Software. https://www.contractsfinder.service.gov.uk/Notice/0c8bcdcb-9212-4876-b991-9c63dcddb061
- Contracts Finder, London Borough of Merton, awarded contract notice published 10 March 2025, Orlo (trading as SocialSignIn), £26,650. https://www.contractsfinder.service.gov.uk/Notice/22d68b2a-80b2-4111-8a4e-5578d7976be3
- Contracts Finder, Islington Council, awarded contract notice published 28 August 2024, SocialSignIn Ltd, £22,881.90. https://www.contractsfinder.service.gov.uk/Notice/c8029a75-1099-4e03-9e76-346cb8787e64
- Devon County Council, Questions to Cabinet Members with responses, County Council meeting of 5 September 2024, question 1 (X account dormant; "We do monitor the platform"). https://democracyindevon.moderngov.co.uk/documents/s49436/QM%205.9.24%20with%20responses.pdf
- Government Digital Service, "Social media playbook", GOV.UK guidance, first published 17 August 2018, last updated 23 January 2023 (social media listening; Cabinet Office Media Monitoring Unit; recording disruptive users; blocking as a last resort). https://www.gov.uk/guidance/social-media-playbook
- Department for Transport, "Social and digital media analysis privacy notice", updated 23 September 2026. https://www.gov.uk/government/publications/dft-privacy-notices-trials-research-online-forms-webinars-transport-sanctions-and-surveys/social-and-digital-media-analysis-privacy-notice
- Runnymede Borough Council, "Social Media and e-newsletter privacy notice". https://runnymede.gov.uk/directory-record/320/social-media-and-e-newsletter-privacy-notice
- East Sussex County Council, "How we use social media (our policy)". https://www.eastsussex.gov.uk/contactus/social-media/social-media-policy
- Kirklees Council, "Social media" (Kirklees Together), moderation and screenshot policy. https://kirkleestogether.co.uk/be-social/
- WhatDoTheyKnow, the public Freedom of Information request service run by mySociety. https://www.whatdotheyknow.com/
- Information Commissioner's Office, "Getting copies of your information (subject access request)". https://ico.org.uk/for-the-public/getting-copies-of-your-information-subject-access-request/