"Meta AI non-compliant with GDPR" – Digital rights group menaces Meta with injunction over EU AI training

noyb has sent a cease and desist letter asking to halt Meta AI training scheduled to kick off on May 27 as an opt-out option. Here's all you need to know.

May 15, 2025 - 16:36
 0
"Meta AI non-compliant with GDPR" – Digital rights group menaces Meta with injunction over EU AI training

  • Austria-based digital rights group, noyb, has sent a cease and desist letter to Meta over its AI training plans in the EU
  • All public posts and user interactions are set to feed Meta AI in the EU starting from May 27, 2025, as an opt-out option
  • Unlike what Meta claims, noyb argues Meta AI training isn't compliant with GDPR and threatens to file an injunction as a potential next step

Austria-based digital rights group noyb is threatening Meta with an injunction over its AI training plans in the EU, arguing these aren't compliant with data privacy laws.

The big tech giant is set to feed its Meta AI models with all public posts and users' interactions starting from May 27, 2025, as an opt-out option. This means that European Facebook and Instagram account holders must fill out an objection form before this date if they don't wish any of their data to be used. Yet, noyb argues Meta should ask for opt-in consent instead, as per GDPR rules.

The group led by privacy activist Max Schrems has already filed a cease and desist letter against Meta on Wednesday, May 14, asking the company to halt its current plans. An injunction and potential class actions could be the next steps if Meta AI training goes ahead as it stands, said Schrems – something that could lead to substantial damage claims from affected users.

TechRadar needs you! We want to know what you think about the world of VPNs. Whether you're a novice or a VPN pro, we want to hear your thoughts. Don't worry, though, your responses are completely anonymous, and it takes less than a minute to complete!

To take part, click the link below: https://futurenet.questionpro.eu/tr-vpn

The legitimate interest conundrum

According to noyb, the legal conundrum around Meta AI lies in how the social media giant plans to use the legitimate interest provision ruled by Article 6(1)(f) of GDPR, which allows companies to collect and process users' data without freely given users' consent.

Examples of legitimate interest include using people's data to prevent fraudulent activities, processing client data for customer service purposes, or managing employee relationships.

"The European Court of Justice has already held that Meta cannot claim a 'legitimate interest' in targeting users with advertising. How should it have a 'legitimate interest' to suck up all data for AI training?" said Scherms, arguing that in Meta AI case legitimate interest is "neither legal nor necessary."

Furthermore, companies are also required to conduct a multi-factor legitimate interest assessment to determine if using this provision does not negatively impact on individual's rights and freedoms.

Noyb, however, argues that Meta AI training won't be able to comply with other GDPR rights, such as the right to be forgotten or the right to access their data afterwards. That's because, once in an LLM database, it's very hard (if not impossible) to retrieve the data.

Commenting on this, Schrems said: "Meta simply says that its interest in making money is more important than the rights of its users."