4 days Ago By Thomas Claburn
Meta on Monday said it plans to start training its AI models using public posts and comments shared by adults in the EU, along with interactions users have with its chatbot. The Facebook goliath said users will begin receiving in-app and email notifications explaining what data will be used - which excludes private messages and any content from those under the age of 18. These notices will include a link to an objection form, to opt out, which Meta insists is easy to use and will be honored.
"This training, which follows the successful launch of Meta AI in Europe last month, will better support millions of people and businesses in the EU by teaching AI at Meta to better understand and reflect their cultures, languages and history," the social ad biz said . Last year, Meta - which owns WhatsApp, Threads, and Instagram as well as Facebook – agreed to pause plans to train its AI models on public content from EU users following complaints from privacy advocacy group NOYB. Meta – which develops internal and openly available neural networks, such as the Llama series – primarily did so at the request of the Irish Data Protection Commission (DPC), expressing disappointment at the time.
Lack of access to public content shared by Europeans, Zuck & co argued, would limit the ability of its AI models to understand what's happening on social media. The American tech giant argued that Europeans will be ill-served by culturally incompetent AI models. At the request of the DPC, the European Data Protection Board (EDPB) in December published an opinion about how the fundamental data protection rights recognized under Europe's General Data Protection Regulation (GDPR) can be reconciled with AI models and how they get trained.
The decision looks at: The circumstances under which an AI model can be considered anonymous, how data controllers can show they have a legitimate interest in data as it applies to AI model training and deployment, and what are the consequences when an AI model is deemed to have unlawfully processed personal data. Critics argue the EDPB position leaves room for interpretation, potentially giving companies legal wiggle room in the name of fostering AI-driven economic growth, including incentives tied to datacenter investments. "AI technologies may bring many opportunities and benefits to different industries and areas of life," EDPB chair Anu Talus said in a statement last December.
"We need to ensure these innovations are done ethically, safely, and in a way that benefits everyone. The EDPB wants to support responsible AI innovation by ensuring personal data are protected and in full respect of the GDPR." The situation is similar in the UK, where concerns about AI fairness and data privacy have taken a back seat to the government's push for AI-led economic growth.
With its regulatory obstacles flattened, Meta last month began rolling out Meta AI in the EU , the first step toward making its chatbot available across Europe for Facebook, Instagram, WhatsApp, and Messenger. Lukasz Olejnik, an independent data protection consultant and researcher, told The Register , "I assume Meta intends to rely on legitimate interests as the legal basis, given the absence of consent, the use of an opt-out mechanism, and their previously stated intentions. This points to Article 6(1)(f) GDPR.
As recalled by the EDPB in its December 2024 opinion, this requires a lawful, specific, and real interest, demonstrable necessity, and a proper balancing test against data subjects’ rights and freedoms. In other words, standard GDPR stuff." Olejnik said he believes the legitimate interest justification is fair for data shared directly with Meta's AI assistant, noting that GDPR is not hindering the use or development of AI.
The tricky part is applying it to general platform content — like posts or photos we posted 2 or 10 years ago – did we expect it to be used to train AI in 2025? "The tricky part is applying it to general platform content — like posts or photos we posted 2 or 10 years ago – did we expect it to be used to train AI in 2025?" he said. "This raises purpose limitation issues, as users definitely did not expect such data to be used for AI training in, say, 2009. According to the CJEU [Court of Justice for the European Union], processing must be strictly necessary, users must be clearly informed of the interest pursued, and the context must support reasonable expectations.
The in-app notification is Meta’s attempt to meet this requirement and this is also fine. "Still, there remains a distinction, duality: training on AI-specific inputs is acceptable under this standard, but broader reuse may not be, or at least not in such a simplistic manner. And Meta intends to train on all user interactions across all its products.
" Olejnik said both the CJEU and EDPB emphasize that repurposing data in this way should be strictly necessary and subject to purpose limitation checks. "If I understand correctly, Meta claims to have consulted DPAs [Data Protection Authorities] and received further guidance, so I hope these matters are sufficiently proofed. If not, we may see future DPA actions or complaints filed.
While I repeat that the GDPR does not hinder AI development, there is growing concern about whether it is being enforced adequately." Olejnik explained, "External observers are starting to wonder if GDPR enforcement around AI processing isn’t a flaming shitshow. I mean — I’m still waiting for any information or decision regarding my GDPR complaint against OpenAI, filed back in 2023.
" ®.
