Meta Faces More European Legal Hurdles Over AI Data Training

Social media giant Meta is likely to face more legal hurdles over its plans to use the personal data of European Facebook and Instagram users to train artificial intelligence models.

See Also: OnDemand | Fireside Chat: Staying Secure and Compliant Alongside AI Innovation

Austrian rights group None of Your Business on Wednesday sent a cease and desist order to Meta after the California-based company announced last month it would resume feeding public posts and comments made by adult users into its training data set.

That violates the General Data Protection Regulation Act, NOYB asserted. German consumer group VZ NRW applied for a preliminary injunction against the company’s plans.

Meta paused efforts to train AI with European data in June 2024 after the Irish Data Protection Commission applied pressure (see: Meta Delays Data Harvesting for AI Plans in Europe).

Meta has cited the GDPR’s “legitimate interests” basis for processing data as the legal foundation for its plans. The European Data Protection Board boosted that assertion, Meta says, through a December 2024 opinon setting out the conditions under which a company could use user data to develop a conservational chatbot. Among them, masking personal data, giving users an option to opt out, excluding some personal data and proactively informing users about the AI training data collection.

NOYB said the opt-out offered by Meta doesn’t meet the GDPR threshold because the social media giant wants it to apply to user decisions made before training has started. Other GDPR rights also conflict with Meta’s training plans, NOYB said, such as the right to be forgotten and the right to have incorrect data corrected.

“The legal solution under the GDPR is simple: Meta would just have to ask users for an opt-in consent (instead of an opt-out objection) to use their personal data for AI training,” the organization wrote.

Schrems said that his organization is planning to file a class action for non-material damages. “If you think about the more than 400 million European Meta users who could all demand damages of just 500 euros or so, you can do the math. We are very surprised that Meta would take this risk just to avoid asking users for their consent.”

German consumer group VZ NRW said Meta’s data processing violates GDPR, as well as the European Union’s competition law, the Digital Markets Act. The rights group had earlier warned Meta about its data processing practices.

Responding to the German consumer group, Meta said its data processing is a “common” industry practice used for AI development. Any attempt to omit personal data would be a “major setback for German consumers who want locally relevant AI technology,” Meta said.

“This is not just about Meta. Numerous AI companies have already suffered delays in the introduction of technologies in Germany and the entire EU, which is due to the fragmented and overlapping regulatory system in Europe,” the company said.