Emer Walsh: The battle to stop companies using our data to train AI models and chatbots (2024)

The DPC was one of 11 national privacy watchdogs urged by the advocacy group NOYB (None Of Your Business) to stop Meta from enacting its plan, warning that recent changes soon to come into effect would allow the tech giant to use years of personal and tracking data for its AI technology.

According to Meta, it could use information such as photos, captions, videos, and any interaction with the platform’s AI, but said it would not use private messages between users.

“Given the short time since Meta has introduced its changes to irreversibly ingest the entire data sets of more than 400m EU/EEA data subjects for undefined ‘artificial intelligence’ technologies, without any indication as to the purposes of such systems, we see the urgent need to file this complaint,” NOYB told the data privacy watchdog.

The company will start implementing its new AI training plan on June 26, giving Meta users just a few weeks’ notice of its objectives. Its proposed changes have sparked several data privacy concerns among advocacy groups, with criticisms ranging from a lack of transparency to the plan’s irreversible implications.

In its letter to Ireland’s privacy watchdog, NOYB argued that Meta had “no legitimate interest” that would override the interest of any data subject, adding that the company had “no other legal basis” to process such vast amounts of personal data for “totally undefined purposes”.

The tech giant has also come under fire for discouraging people from opting out of its plan and for making the process more difficult than it should be. Rather than Meta asking for consent, users must actively opt out of the new plans, with even that process being made more complicated than necessary, NOYB said.

The social media giant is requiring users to fill out a form detailing why they object to the use of their data in its AI training and explain how it will affect them personally.

Subsequently, the tech giant says it will review these requests and if honoured, they will apply going forward.

However, due to Europe’s General Data Protection Regulations (GDPR), Meta is forced to offer an opt-out option for all European users, meaning any request made by people in the EU must be honoured. People in other areas of the world are not so lucky.

“Meta has taken every step to deter data subjects from exercising their right to choose, by pretending that data subjects would only enjoy a right to object [“opt-out”] instead of relying on consent [“opt-in”] and by entertaining extensive dark patterns to deter users from objecting under Article 21 GDPR,” NOYB said in its complaint to the DPC.

In addition, the letter also argues that Meta “fails to provid the necessary ‘concise, transparent, intelligible and easily accessible’ information, ‘using clear and plain language’”.

Meta rejected NOYB’s criticism, referring to a blog post from May in which it said it uses publicly-available information to train AI, as well as information that has been shared publicly on its services. However, in a message to Facebook users, the company said it may still process data about people who are not on the social media site if they appear in an image or caption shared by another account.

“Meta says itself that it is not able to properly differentiate between data subjects where it can rely on a legal basis to process personal data and other data subjects where such a legal basis does not exist,” NOYB continued in its complaint.

However, a spokesperson for Meta said the company was confident that its approach complies with privacy laws, and that it was consistent with how other tech companies are developing and improving their AI experiences in Europe, including Google and Open AI. But it’s not just Meta coming under scrutiny.

In December last year, The New York Times sued OpenAI for copyright infringement, alleging the firm’s AI technology illegally copied millions of articles to train language models including ChatGPT to provide people with instant access to information — technology that now competes with traditional newspapers including The New York Times.

Despite the legal battle with NYT, just last month, social media site Reddit confirmed that it would allow Microsoft’s OpenAI to use content from the website to train ChatGPT as part of a deal worth around $60m (€55m).

NOYB has already filed several complaints against Meta and other major tech giants over alleged breaches of GDPR, which carry fines of up to 4% of a company’s total global turnover for violations.

Meta has previously argued that it had a legitimate interest in using users’ data to train AI models and other tools, which can be shared with third parties. However, NOYB founder Max Schrems said that Europe’s top court had already ruled on this issue in 2021.

“The European Court of Justice has already made it clear that Meta has no ‘legitimate interest’ to override users’ right to data protection when it comes to advertising,” he said. “Yet the company is trying to use the same arguments for the training of undefined ‘AI technology’. It seems that Meta is once again blatantly ignoring the judgments of the CJEU,” Mr Schrems said, adding that opting out of the plan was extremely complicated.

Speaking to the Irish Examiner, a spokesperson for the DPC said it was continuing to look into the issue. “I can confirm that this matter is still subject to extensive engagement between the DPC, our colleague EU Data Protection Authorities, and Meta, with a number of significant issues continuing to be assessed for GDPR compliance,” the spokesperson said.

• Additional reporting from Reuters