Update: Both the UK’s Information Commissioner’s Office and the European Commission have now launched investigations into the legality of making it opt-out instead of opt-in.

If you use Instagram or Facebook, Meta is using your data to train its AI models. The company uses posts as training material for its generative AI systems. Privacy legislation in the UK and European Union means that the company is forced to offer an opt-out option – but it is doing so in a rather sketchy way …

We might never know that Meta is using our data to train its AI models were it not for privacy legislation in Europe. This forces companies to disclose the way they acquire, process, and retain data – and to offer opt-outs.

To comply, the company is today emailing Instagram and Facebook users.

We’re updating our Privacy Policy as we expand AI at Meta

Hi <Name>,

We’re getting ready to expand our AI at Meta experiences to your region. AI at Meta is our collection of generative AI features and experiences, such as Meta AI and AI creative tools, along with the models that power them.

What this means for you

To help bring these experiences to you, we’ll now rely on the legal basis called legitimate interests for using your information to develop and improve AI at Meta. This means that you have the right to object to how your information is used for these purposes. If your objection is honoured, it will be applied from then on.

We’re including updates in our Privacy Policy to reflect these changes. The updates come into effect on 26 June 2024.

Thanks,
The Meta Privacy team

It is also using Facebook notifications to display a similar alert.

Notably, the company does not appear to be notifying users outside of Europe.

European users can opt out

Europe’s GDPR is the strongest privacy legislation in the world, and provides four key protections against misuse of personal data:

• There must be a specific, lawful reason to process the data
• Personal data must be encrypted
• You have a right to a copy of your data
• You can ask for your data to be deleted

There are six acceptable reasons for companies to hold your data, one of which is known as Legitimate Interest. This is perhaps the weakest element of the legislation, as it isn’t very well-defined, and includes “commercial interests.” It is this clause Meta is relying on here.

However, even if a company claims legitimate interest, you can still object and ask it to delete your data.

The company’s email says that it will remove your data from its AI training “if your objection is honoured,” suggesting that this is not automatic.

When you click on the link to object, you are asked to state your reason.

Both of these are legally dubious, since they give the impression that you need to come up with some kind of justification for your request. In fact, in these circumstances, where a company is using your data for its own commercial interests and nothing else, it must comply with an opt-out demand.

Fortunately, Meta does seem to be automatically processing opt-outs: When I did so, I immediately received an email to say that it had been approved and would be honored.

Photo by charlesdeluvio on Unsplash