Your Instagram export compared to TikTok's and YouTube's

You have seen the inside of your Instagram archive by now — folders, sharding,
what counts, what is missing. But Instagram is not the only platform that hands
you a package when you ask, and the differences between the packages are not
cosmetic. TikTok and YouTube run the same kind of "download your data" feature,
all three platforms sit under the same EU right, and yet the three archives
disagree about what a person's history even is: how deep it goes, which
actions survive, and whether the numbers can be trusted.

There is now a serious answer to "how do they actually compare": a systematic
academic audit of Data Download Packages (DDPs) from all three platforms,
accepted at IEEE S&P 2026, that compared content field-by-field, tested
reliability with bot accounts holding known ground truth, collected real users'
donated exports across five countries, and surveyed 400 people on whether they
could understand what they received. This post reads that audit with one narrow
goal: what does it mean for you, holding an Instagram export in one hand and
possibly a TikTok or YouTube file in the other.

1. 2minthe four field-level comparisons that surprise people most.
2. 4minthe reliability scores: what a bot with a receipt book proved.
3. 3minwhat the differences mean when you actually hold the files.

The platforms under comparison

The audit picked TikTok, Instagram and YouTube because they offer similar
services — short-format video — which is exactly when the GDPR expects
comparable implementations of the same right. All three are designated Very
Large Online Platforms under the EU's Digital Services Act. The EU right in
question is Article 15 (access) plus Article 20 (portability): if the packages
look nothing alike, moving your history between platforms is harder than the
law intends.⁷

Each platform returns two kinds of package: machine-readable (JSON/CSV) and a
human-readable layer — Instagram and YouTube ship HTML, TikTok ships TXT files
organised into directories.⁵ Both layers of the same request can
disagree: that inconsistency inside Instagram's own package (a content URL
present in likes, absent in watch history) is one of the audit's
platform-specific findings.

Four comparisons that surprise people

1. Watch history: three different memories of the same behaviour.

All three watched the same kind of video; only YouTube remembers all of it, and
no platform discloses the criteria for its cut.² For you, the Instagram
row means your archive's browse history is a slice, while your like history
reaches back much further — a difference in retention decisions, not in what
you did. (The Article 15 post covers why no criteria were disclosed; the
folder-structure post covers what the three files mean inside your ZIP.)

2. Likes: one platform's package simply doesn't have them.
TikTok gives a link to the liked content and when; Instagram gives the link,
the author and when; YouTube's own package contains no like history at
all — the audit notes it exists in Google's separate DDP, but not in the
YouTube one a YouTube user would request.³ If you have ever assumed
"download my data" is a complete verb across platforms, this is the clearest
counterexample: the same action, three different levels of existence.

3. What you said and shared vs what you watched.
Across the audit's full field matrix, search, save and in-app share are in all
three packages where the feature exists; messages exist only where the
platform has them (TikTok and Instagram yes, YouTube not applicable); sharing
outside the app — copy-link, cross-post — appears only in TikTok's
package; and inferred interests/topics lists ship from TikTok and Instagram
but not YouTube.⁸ Time-spent-per-day is shown in all three apps and
handed over by none of them — TikTok's "Activity Summary" (counts of videos
watched to the end, commented on, shared) is the closest either gets.

4. Personal detail: more is not automatically better.
TikTok's login history row carries timestamp, IP, device model, OS, network
type and carrier. Instagram's carries all of that plus cookie information,
language code, app version, display properties, a hardware identifier and
internal identifiers. YouTube's own package carries none of it (Google's DDP
does). The audit cuts this finding both ways: either TikTok collects these
details and withholds them from you, or Instagram's collection itself is broad
enough to warrant scrutiny under data minimisation.⁶ And on
advertising — the subject of this site's advertising-profile post — Instagram
is the only one of the three that ships the advertisers-who-used-your-data
list with targeting methods (custom audience, remarketing, in-person store
visit), while none of the three discloses why any particular ad was
shown.⁹

The reliability test: bots with receipts

Field comparisons say what could be in the package. The audit's second
question was whether the package matches reality. Method: sock-puppet accounts
that browsed 20–25 short videos per session with random 15–60-second watch
times and random likes, with browser traffic captured to HAR files as ground
truth — roughly thirty sessions per platform across October–December 2024 —
then requested each account's package and diffed it against the logs, plus
package-vs-package re-requests to test consistency, plus real users' donated
exports across five countries for the cross-account view.¹⁰

• Completeness. TikTok: 100% of logged browsing and likes present. YouTube:

  99.5%. Instagram: home-feed activity complete, but videos watched in the
  reels feed were missing from the package while the likes for those same
  videos were present.⁴

• Correctness (order and timestamps). TikTok scored 100% on date, context

  and overall similarity. YouTube: 100% date, 99.83% context. Instagram's
  likes matched 100%, but its browsing rows scored lower — partly
  username changes in the ground truth, partly timestamp drift of up to a
  minute against TikTok's and YouTube's ±5 seconds.¹¹

• Consistency. Re-requesting from the same account: Instagram's browsing

  window varied between snapshots (6 to 13 days of coverage for the same
  account), and 6% of like-history entries vanished between two later
  snapshots. Across real users, Instagram and TikTok returned different
  periods for different activity categories, while YouTube's categories all
  covered a similar duration.¹²

Read that carefully and one thing is clear: "the export is incomplete" is not
a universal property of these features. On the audit's numbers, TikTok's
package was the most complete and consistent, YouTube's was near-complete,
and Instagram's had a specific, reproducible hole (reels watch history)
alongside drifting windows. None of that makes your own ZIP wrong — it tells
you which kinds of absence are platform patterns rather than your
misconfiguration, which is exactly the difference between "I downloaded it
wrong" and "they didn't hand it over".

What the humans said

The audit's third leg surveyed 400 participants in Germany, France, Italy and
Spain on whether they could understand their packages. Result: current packages
substantially fall short of the GDPR's own "concise, transparent, intelligible,
easily accessible, clear and plain language" standard — with Instagram's
package rated the most comprehensible of the three.¹³ The deeper
finding: some of the legal requirements conflict in practice. Participants
read "concise" as prioritise what matters and "transparent" as disclose
everything — you cannot maximise both in one document. The audit's proposed
answer is layered: better data representations inside the package, plus an
optional visualization layer (their "Know Your Data" extension) where the
reader picks their own point on the conciseness-vs-completeness slider.

This matters for how you read your own archive: the flat JSON you opened is
layer zero of an answer the regulators and researchers are still designing
around. A tool that renders counts over your rows — like this one — is one
concrete shape of that second layer, and it happens to be running on your own
machine with no upload.

What this means if you hold more than one export

• Depths are not comparable across platforms. Two weeks of Instagram browse

  history next to a lifetime of YouTube watch history does not mean you used
  one more than the other. Compare within a platform, or align windows
  deliberately, before drawing any conclusion — the comparison view in this
  app exists for the same reason: two exports side by side must state their
  periods or the diff lies.

• Likes are the canary. If a platform's package lacks like history, assume

  other engagement categories may be absent too, and check a second source
  (Google's DDP for YouTube) before concluding the data doesn't exist.

• Format decides who can read it. JSON and HTML are for machines and

  browsers respectively; TXT directories and CSV split differently; the same
  request answered in two formats is where internal inconsistencies show up
  first.

• Missing ≠ deleted. The audit measured what packages contain. The

  Article 15 post's rule still holds for every platform here: an absent
  category in a package says nothing about what is still processed on the
  server — only about what was handed over.

Questions this comes up

The Article 15 post for the right itself and the three shared disclosure
failures; the how-to-request post for getting your own package out of
Instagram; the what's-in post for the folder map once it arrives; the
eight-things post for absences no platform's package fixes; the
why-your-export-is-missing-half-your-life post for why partial history is the
normal case, not the exception.

¹: Karnam, Dash, Das, Mousavi, Bechtold, Gummadi, Mukherjee, Weber,
Zannettou. Setting the Course, but Forgetting to Steer: Analyzing Compliance
with GDPR's Right of Access to Data by Instagram, TikTok, and YouTube,
arXiv:2502.11208v3 (accepted, IEEE S&P 2026). Comparison tables are the paper's
Tables I–III (field-level platform comparison, "as of Dec 2024").
²: Audit Table I: watch history — duration (YouTube: entire lifetime;
Instagram: 2 weeks; TikTok: ~6 months), content URL, timestamp, title, author,
ad identification, file segmentation (Instagram: three files — ads, posts,
videos watched).
³: Audit Table II: like history — TikTok (link, timestamp), Instagram
(link, author details, timestamp), YouTube (absent from its DDP; present in the
Google DDP; shown in-app only).
⁴: Audit §IV-C, Completeness: TikTok 100%; YouTube 99.5% of HAR-logged
entries; Instagram home feed complete, reels-feed watched videos absent from
the DDP while their likes were present.
⁵: Audit §III-A: machine-readable (single/collection of JSON/CSV);
human-readable — Instagram and YouTube HTML, TikTok TXT across directories.
⁶: Audit §III-D: TikTok login row (timestamp, IP, device model, OS,
network type, carrier); Instagram adds cookie information, language code, app
version, display properties, hardware identifier, internal identifiers;
YouTube's own DDP omits login history (Google's includes it). The audit raises
both possible readings — withheld collection vs over-broad collection under
Article 5(1)(c) data minimisation.
⁹: Audit §III-E: only Instagram and YouTube demarcate ads viewed (TikTok
does not); YouTube labels ads inside watch history with title/URL/advertiser/
timestamp, Instagram keeps a separate list with advertiser name and timestamp
only; no platform discloses ad-targeting parameters. Instagram alone ships the
advertisers-using-your-data list with the three targeting methods (custom
audience, remarketing custom audience, in-person store visit).
⁷: Audit §I–II: similar-service platforms should offer comparable
Article 15 implementations; inconsistency undermines Article 20 data
portability. All three are EU-designated VLOPs under the DSA.
⁸: Audit Table III (data transparency overview): search/save/in-app
share present across applicable platforms; messages — TikTok and Instagram
yes, YouTube N/A; cross-app share — TikTok only; interests/topics — TikTok and
Instagram, not YouTube; time spent — none (TikTok's "Activity Summary" is a
partial recent addition); account changes — Instagram only; link history and
cookies — Instagram only; off-platform activity — TikTok and Instagram, not
YouTube.
¹⁰: Audit §IV-A–B: pyautogui/opencv-driven sock puppets, 20–25 videos
per session, 15–60s random watch, random likes, HAR ground truth, ~30 sessions
per platform, October–December 2024; real-user donations from Germany, France,
Italy, Spain (+ UK, Brazil, USA, India), anonymised at the front end; private
messages never collected.
¹¹: Audit Table V (average Jaccard similarity, HAR vs DDP): TikTok
browse/likes 100/100/100; Instagram likes 100/100/100, browse 96 date /
97 context / 91 overall; YouTube browse 100 date / 99.83 context / 99.5
overall. Timestamp deviation ±5s (TikTok, YouTube) vs up to one minute
(Instagram); Instagram browse drift attributed partly to username changes in
ground truth.
¹²: Audit §IV-C, Consistency: same-account re-requests —
Instagram's covered browsing duration varied 6–13 days across snapshots; 6% of
like-history entries missing between snapshots 3 and 4; real users showed
category-dependent periods on Instagram and TikTok, uniform periods on YouTube.
¹³: Audit §V: 400 participants across Germany, France, Italy, Spain;
current DDPs substantially fall short of Article 12(1) standards; Instagram's
rated most comprehensible of the three; conciseness-vs-transparency
interpretations found to conflict in practice.