Meta begins training AI using EU citizens’ data, but the fight’s not over yet

Meta can train its AI models using the public posts of European Instagram and Facebook users. But an expert tells Cybernews that a German court's decision to reject an injunction against the company doesn’t mean there will be no restrictions.

In April, Meta surprised many by announcing that it will use public posts and comments shared by its Instagram and Facebook users for training its AI models. The company claimed this will “support millions of people and businesses in Europe.”

It’s not clear how exactly, but Meta indeed needs a huge pool of data to train its AI and wants to be able to dive into its social media platforms, which have billions of members and billions upon billions of pieces of content.

The move has been contested by privacy experts who argue it’s against the EU’s General Data Protection Regulation and ask whether Meta can really simply suck up all of its users’ data.

Green lights from Germany and Ireland

However, all those challenges weren’t successful. First, Ireland’s Data Protection Commission, which oversees Meta's compliance with the European Union’s data protection rules, said it didn’t oppose the company’s plans to train its AI on EU users’ data.

Then, the Higher Regional Court of Cologne rebuffed the German consumer group VZ NRW's attempt to stop Meta from ingesting public social media posts as AI training material.

Finally, the Hamburg data protection authority (DPA) also said it would not go ahead with its urgency procedure to stop Meta's plan, as it has decided not to be the only EU supervisory authority ruling against the tech giant.

“Given the forthcoming EU-wide evaluation of Meta's practices, an isolated urgency procedure for Germany is not a suitable path,” the Hamburg DPA told Euractiv.

All this means that as of Tuesday, May 27th, Meta is using EU users’ data to train its AI. The firm itself said that users can decline their data being used by filling out two separate forms, each dedicated to Facebook and Instagram users, unless they have a linked account. Those who have their Meta accounts linked only need to fill out one form.

Still, this is an opt-out option that users have to actively seek. According to critics, Meta should instead be asking consumers for an opt-in consent, and some activists are optimistic that the tech giant will still have to change its ways.

An unenviable situation?

“This is just the very beginning of the story. Whilst it’s quite unlikely that EU authorities will impose a flat ban on AI training with Personally Identifiable Information (PII) of European residents, some important restrictions may come into play,” Dr. Ilia Kolochenko, CEO of cybersecurity company Immuniweb, told Cybernews.

Meta might also need to deal with sophisticated pre-screening of users' posts that contain illicit materials, calls to violence, or discrimination, as well as posts that infringe copyright.

Dr. Ilia Kolochenko.

In his view, the current opt-out method used by Meta is likely to be replaced by an opt-in method, explicitly asking users whether they wish to do their data to be used for AI training prior to the activation of the process.

“Second, children may be excluded from the AI training program altogether, or strict parental consent will be required,” said Kolochenko.

“Third, the most problematic thing is the exercise of data correction and data deletion rights by data subjects: once erroneous PII is ingested by a large language model, it’s extremely difficult to remove or correct it. This is where Meta will probably face the biggest challenge in complying with GDPR.”

According to the expert, Meta might also need to deal with sophisticated pre-screening of users' posts that contain illicit materials, calls to violence, or discrimination, as well as posts that infringe copyright.

“In sum, Meta’s situation is currently quite unenviable,” Kolochenko told Cybernews.