Scraped Parler data is a metadata gold mineScraped Parler data is a metadata gold mine

In the days after the January 6, 2021, attack on the US Capitol, the social network Parler faced imminent shutdown. Apple and Google had pulled its app from their stores, and Amazon Web Services announced it would stop hosting the platform. Before Parler went offline on January 10 and 11, a hacker and researcher using the handle donk_enby coordinated an effort to download as much of the site's public content as possible, ultimately archiving roughly 70 terabytes of posts, images and videos.

The scrape was possible because of basic weaknesses in Parler's design. Posts and media were stored at sequential, predictable addresses, so automated tools could simply count through them. The platform appeared to lack meaningful rate limiting, and content that users believed they had deleted was often still retrievable. Some endpoints also did not require authentication, allowing bulk downloads at speed.

The most consequential flaw was Parler's failure to strip metadata from uploaded videos and photos. Mainstream platforms routinely remove embedded EXIF data, which can include precise GPS coordinates, timestamps and device details. Parler did not, which meant many videos carried the exact location where they were recorded. Analysts and journalists quickly used the data to map footage filmed inside and around the Capitol on January 6, and the archive became a resource for investigators and reporters documenting the riot.

Parler disputed characterizations that it had been hacked, and the content collected was largely material users had posted publicly. But the episode raised privacy concerns even among those who welcomed its use in criminal investigations, because the archive also swept in location data from users who had nothing to do with the riot. Parler eventually returned online with a new hosting provider and later changed ownership several times before shutting down in 2023.

The Parler scrape is widely cited in discussions of secure platform design. It showed how sequential identifiers, missing rate limits, soft deletion and unstripped metadata can combine to expose far more than a company intends. It also illustrated a point that applies to any user of any service: photos and videos can reveal precise locations unless the platform, or the user, removes that information before posting.