Digital rights NGO Noyb has filed 11 complaints across Europe over changes in Meta’s privacy policy that will allow the owner of Facebook and Instagram to use posts and images, among other things, to train its artificial intelligence (AI) model, according to a Thursday (6 June) press release.
Noyb, founded by Austrian activist and lawyer Max Schrems, has filed some of the most consequential privacy complaints in the EU.
It is asking for an urgent decision by the 11 data protection authorities, in Austria, Belgium, France, Germany, Greece, Italy, Ireland, the Netherlands, Norway, Poland, and Spain, before the changes take effect on 26 June.
Meta is “confident” that it is compliant with EU privacy law, a spokesperson said and directed Euractiv to a May 2024 blog post on its AI development. The post says Meta is “Developing AI Responsibly” before it brings it to the EU and UK, and uses publicly available information.
It is the latest installment in the battle over what data can be used to train AI models. Generative AI, such as chatbots like ChatGPT and image generators like Midjourney, use vast amounts of data, often scraped from the internet without user consent, to train the models that can then churn out content.
The use of personal data is governed by the GDPR, the EU’s landmark data privacy regulation, which can allow companies to do so if they have “legitimate interest”.
That, however, is a murky concept that can include the purposes of business activities. It also requires the data controller, in this case Meta, to weigh its interests against the users’ right to privacy.
Users must be informed about the use of their personal data for legitimate interest.
Changes to Meta’s privacy policy will allow the company to collect user posts from Facebook, Instagram, and other Meta platforms, to train such generative AI models. Private messages between individuals are not included in the policy. Messages with businesses are also not included, Meta told Euractiv.
This would include information dating back to 2007, Noyb said.
Publicly available information is still subject to data protection law, the European Data Protection Supervisor has repeatedly said, as recently as 3 June.
Noyb argues that users are not given a substantial choice over the matter. Users do not have to “opt-in” to this change, which will take effect automatically, while opting out is “extremely complicated,” as opposed to simply clicking a button, Noyb said.
On Meta’s privacy policy page, users are given the option to object to the processing of their data for AI training. Clicking on the page redirects towards a form they have to fill in and submit.
Noyb argues that Meta’s purpose in training this AI is not clear.
On “AI at Meta” page, Meta says it is creating a “collection of generative AI features and experiences, such as Meta AI and AI Creative Tools”, some of which will be made available to researchers.
The tools will “helps people solve complex problems, be more imaginative, and create something never seen before” such as “bringing real-time answers to chat” and “giving them more ways to express themselves”, Meta says.
The changes are “particularly worrying”, according to Noyb, because they involve “the personal data of about four billion Meta users, which will be used for experimental technology essentially without limit”.
At least EU users should be protected under the GDPR, the organisation said.
