back to article Meta faces multiple complaints in Europe over plans to train AI on user data

Meta's plans to use customer data in AI training have resulted in complaints to data protection authorities in 11 European countries. The complaints were filed by privacy activist group noyb following updates to Meta's privacy policy. The updates are due to take effect worldwide on June 26. The main issue, according to noyb, …

  1. Elongated Muskrat Silver badge

    Opt Out Now!

    A spokesperson for Meta told The Register: "We are confident that our approach complies with privacy laws, and our approach is consistent with how other tech companies are developing and improving their AI experiences in Europe."

    For starters, requiring you to opt-out of your data being processed is a GDPR no-no. I managed to do so, and they didn't make it easy - click on a non-obvious link in the middle of the "changes to terms" notification they send you (mixed in with your other notifications), and then fill in a form (including submitting and verifying your email address) giving them your grounds for objecting. I told them it was on the grounds of violation of my privacy, and they responded that I had been opted out "successfully", but I should not have had to do this. It seems like a clear GDPR violation to me.

    1. James 51

      Re: Opt Out Now!

      I had the same process. Live in the UK but was able to opt out too.

      1. unimaginative
        Facepalm

        Re: Opt Out Now!

        The Uk is in Europe. More importantly the UK has GDPR like laws.

        Various countries have GDPR like laws.

        You cannot scrub specific data from an 'AI' without retraining it from scratch.

    2. Anonymous Coward
      Anonymous Coward

      Re: Opt Out Now!

      AC me that downvoted just because... for whatever reason you a still use it.

    3. Anonymous Coward
      Anonymous Coward

      Re: Opt Out Now!

      The opt-in is mandatory for two reasons; not only is a European default, it is also a change of how they (ab)use your personal data, which again requires positive permission, not an implied one.

      1. Snowy Silver badge
        Mushroom

        Re: Opt Out Now!

        They go with by continuing to use Facebook you agree to let them use your data how they want to.

    4. Nematode

      Re: Opt Out Now!

      Also managed to do this, though only at the second attempt, of course whether they will respect my opt-out is dubious. Have totally failed to do same with my wife's account. If my key medical support group wasn't on FB, I'd be outta there.

      1. Zakspade

        Re: Opt Out Now!

        Same here. Took a couple of attempts (link took me to a Holding Page telling me something was broken, before later in the day finally allowing me to lodge my objection).

        The thing is: how do I know that FB doesn't ignore me - despite their email telling me that my APPLICATION to opt-out has been accepted and will be acted upon? Exactly - zero way to know and I very strongly suspect the "opt-out" is merely 'window dressing' and PR. Had they looked at it as a serious thing with proper intent, FB would have realised that the very fact of having to opt OUT rather than being asked to opt IN breaks the very laws they claim to be adhering to...

      2. hoola Silver badge

        Re: Opt Out Now!

        I simply don't trust them to not already be doing this, not honouring the opt out and never providing any evidence that the data was not used.

        Bluntly, the likelihood of them not already using the data for this sort of thing is very low.

      3. I could be a dog really Bronze badge

        Re: Opt Out Now!

        If my key medical support group wasn't on FB, I'd be outta there

        And why is that group using it ? No group should be forcing users to use an illegal service (or at least, a service run my known criminals, and clearly in defiance of known laws).

    5. Anonymous Coward
      Anonymous Coward

      I "Deactivcated" my Facebook account 8 years ago

      Rather than "delete" it, I thought maybe some day I might want to use it.. So I no longer get emails from them and I have never accepted any updated terms.. Nor do I have any means to specifically "opt out".

      What is the law's position on Meta using deactivated account data to train AI, from users who have never consented to such use?

      1. I could be a dog really Bronze badge

        Re: I "Deactivcated" my Facebook account 8 years ago

        Simple - it is illegal<period>

        So they'll go ahead and do it anyway.

        If i were a user I would be very tempted to put some very specific stuff (e.g. some random text strings) in my account so that later I could do a search for those strings and see what comes up. That way, if the search returned those unique strings despite me having opted out, I could demand they delete my data. I could imagine the exchange :

        Me: Delete my data as required by law.

        FB: We can't it's embedded in teh AI model and can't be deleted without deleting the whole model.

        Me: So, you still have to delete my data.

  2. Mike 137 Silver badge

    "Rather than Meta asking for consent, users must opt out of the default data slurp"

    I conjecture from your comment "giving them your grounds for objecting" that the lawful basis for processing being relied on is Legitimate Interest (Article 6.1(f)), as the requirement to give grounds that you state applies to the Right to Object under Article 21. Consequently, consent is irrelevant as it is not the lawful basis in this case. The common assumption that consent tops the list of lawful bases is incorrect. Properly applied, it is probably one of the least useful lawful bases, and it certainly doesn't exist as a super-layer over the others. So it's equally fallacious that data subjects can invoke consent as a universal means of objecting to processing regardless of the lawful basis that applies, but the chief source of this confusion has always been the paucity of information from these behemoth data controllers about the lawful bases relied on for specific processing.

    1. Elongated Muskrat Silver badge

      Re: "Rather than Meta asking for consent, users must opt out of the default data slurp"

      What is Meta's legitimate interest in my personal data? I have no relationship with them as a legitimate processor of my data, and no agreement (beyond the T&Cs of Facebook) with them to do anything at all with my data. Just because they had my data before GDPR existed does not mean they are not bound by it.

      AFAIK "legitimate interest" means usage by organisations that have a statutory requirement to hold that data, such as public service organisations, of which Meta definitely isn't one.

      In other words, for "legitimate interest" to apply, Meta must pass the "three part test":

      Purpose test – is there a legitimate interest behind the processing?

      Necessity test – is the processing necessary for that purpose?

      Balancing test – is the legitimate interest overridden by the individual’s interests, rights or freedoms?

      I think it's pretty clear that any "legitimate interest" claim fails on the balancing test, in that it is clearly not in my interests for my personal information to be freely collected, analysed, and sold, for profit, without any oversight from myself.

      1. Mike 137 Silver badge

        Re: "Rather than Meta asking for consent, users must opt out of the default data slurp"

        "I think it's pretty clear that any "legitimate interest" claim fails on the balancing test"

        Unfortunately this is a weakness of the legislation, in that the balancing test is performed by the party interested in conducting the processing. There is a statutory right to challenge the decision, but you can only do this [a] if you can gain access to the documentation and [b] if you can afford to take the data controller to court. In the UK at least, single complaints about such things attract no serious response.

        Oh and BTW, '"legitimate interest" means usage by organisations that have a statutory requirement to hold that data' is not correct. Any organisation can declare pretty much any processing to be in its (or a 3rd party's) legitimate interest unless it involves processing of the protected categories of data (which expressly require consent). It would then be up to data subjects to get the regulator to challenge it or challenge it themselves. Which is why this basis has been so widely abused.

        1. Elongated Muskrat Silver badge

          Re: "Rather than Meta asking for consent, users must opt out of the default data slurp"

          Any organisation can declare pretty much any processing to be in its (or a 3rd party's) legitimate interest, unless it involves processing of the protected categories of data

          Whilst this is true, I'm of the opinion that unless an organisation has to process my data, then merely wanting to for profit, isn't really legitimate. My own interests in having them not do this overrides their interest in making money off my back, and they should therefore have an explicit opt-in, if they want to do this.

  3. Tron Silver badge

    Go ahead.

    All my social media stuff is 'Public' anyway.

    But who would trust or pay a penny for any 'AI' based on social media? The quality of AI depends in great part upon its source material. Even most news content will be out of date and culturally questionable. Social media content is one step up from 4chan. They are creating a product that no sane person would use. Probably because the idea came from the top and nobody in the room had the balls to point this out.

    1. RegW

      Re: Go ahead.

      > But who would trust or pay a penny for any 'AI' based on social media?

      The Post Office prosecuted a large number of sub-postmasters because they trusted a software system called Horizon.

    2. Anonymous Coward
      Anonymous Coward

      Re: But who would trust or pay a penny for any 'AI' based on social media?

      Excellent question. I think that answer lies in the fact that 98% of actual language usage is oriented towards social bonding, not about debate or logical processing of facts. Facebook is an excellent place to extract data concerned with use of language for social bonding. It will be helpful for building bots that can hold unique one-on-one conversations for such goals as sales, fraud, political indoctrination and monitoring. While that maybe parasitic and unhelpful to mankind, it am certain it will be one giant leap for profitability.

  4. t245t Silver badge
    Boffin

    The AI creators are free-loading on other peoples work.

    The AI creators say their model doesn't keep the original text, so they argue they're not breaking copyright rules. But in reality, the model does hold onto a version of the original data.

    For example, imagine I make a list of every word in a book and where it appears. Then I sell this list, claiming I'm not breaking copyright. However, someone using an algorithm, could use this list to recreate the original text.

    1. Justthefacts Silver badge

      Re: The AI creators are free-loading on other peoples work.

      Yes you could make such a list of a book, and that would not break copyright. If however you describe the algorithm required to reconstruct, that would break copyright. We know this, because what you are describing is just gzipping a book with lossless compression, and selling it, which was ruled copyright breach decades ago.

      So the next question is, are LLMs equivalent to lossless compression. And the answer is, no they aren’t, which we can see trivially from this: LLM parameter sets are a few GB, out of the tens of petabytes they are trained on. So they cannot possibly store and reconstruct their inputs faithfully. LLMs do not violate copyright of the written word.

      There are many other angles, but this isn’t it. For example, MidJourney et al *do* violate copyright on artists images routinely, but that’s different.

      1. Elongated Muskrat Silver badge

        Re: The AI creators are free-loading on other peoples work.

        You claim in the same post, that what you are describing is just gzipping a book with lossless compression and also LLM parameter sets are a few GB, out of the tens of petabytes they are trained on. This doesn't actually demonstrate whether this is lossless compression, or not. Tens of petabytes of written material might well compress down to that size, in a lossless fashion, given the right algorithm.

        In any case, whether it is lossless or not is a bit of a red herring. I could reproduce a grainy and lossy JPEG version of the "golden arches" and stick it on the front of a burger joint, and still expect to get sued out of existence by McDonalds. I think the actual test in law (and of course, IANAL) would be more around whether a reproduction retains the essence of the original.

        1. Justthefacts Silver badge

          Re: The AI creators are free-loading on other peoples work.

          “ I could reproduce a grainy and lossy JPEG version of the "golden arches" and stick it on the front of a burger joint, and still expect to get sued out of existence by McDonalds.”

          Yes indeed. And this is exactly why I try to explain the laws that apply, because they aren’t what people think they are:

          First off; the Golden Arches will be protected as a *trademark* not copyright, and that’s a separate set of conditions. But if a company made a graphic design that wasn’t a logo, they can register that under *design rights*, a different thing again. Now, if it’s an artistic picture, or a photo; that is *copyright*, but it’s a different sort of copyright. It’s literally a different set of pages in the legal code to text, some are the same rules and some are different.

          Copyright of eg a painting, has only to be *similar* not the same, and “intent to deceive” is relevant, as is whether or not you actually used the original to copy (irrespective of the end result).

          Text has to be both *the same*, substantial passages, and have substantial artistic invention and be uniquely identifiable as the work of the originator. Even a page copied directly out of a manual describing how to put together a particular piece of IKEA furniture is not going to be defensible copyright, because there’s only one way to do it, and everyone would describe it similarly. No artistic endeavour, no copyright. Essence of the original is also irrelevant: if you paraphrase, you do not infringe copyright.

          TLDR: people’s experience of when copyright has teeth is almost always music, performances, or photos. Copyright of text is a different law, much weaker

          1. Falmari Silver badge

            Re: The AI creators are free-loading on other peoples work.

            @Justthefacts "Text has to be both *the same*, substantial passages, and have substantial artistic invention and be uniquely identifiable as the work of the originator. Even a page copied directly out of a manual describing how to put together a particular piece of IKEA furniture is not going to be defensible copyright, because there’s only one way to do it, and everyone would describe it similarly. No artistic endeavour, no copyright. Essence of the original is also irrelevant: if you paraphrase, you do not infringe copyright."

            By uniquely identifiable I assume you mean it can't possible be anything other than a copy, then that's the only bit you got right. There has to be substantial passages of the same text, not necessarily. You can't take a published book and translate into another language and publish the translation.

            Therefore essence of the original is relevant, how relevant is dictated by the size of the essence. The closer the resemblance is to an already published work the more likely the copyright owner can successfully sue for copyright infringement.

            Substantial artistic invention! Non fiction is copyrightable, yes even manuals. Instead of IKEA let's take a manual that is published and sold, e.g. a Haynes workshop manual. Copy a page and stick it on the web, that is copyright infringement. Of course it will probably take more than a single page for the publishers go after you.

            But copy the whole manual they will and if they can prove you put it on the web they will certainly be able to successfully sue you for copyright infringement. A manual just tells you how to do things, that's hardly substantial artistic invention.

  5. IanRS

    Will your right to object be effective?

    I've gone through their right to object process, which is pretty deeply buried. You have to provide a reason why you do not want them to use your data, which they will then consider, and may reject. What are the odds that every objection is somehow overturned?

    1. refitman

      Re: Will your right to object be effective?

      I'm in the UK and I just put "don't use my data" and 5mins later got confirmation of being removed from the training data. It's been the same for everyone else I've spoken to about it.

      1. robinsonb5

        Re: Will your right to object be effective?

        Largely the same here, but the confirmation was pretty much instant for me.

        Had the request been denied I'd have had no hesitation in deleting the account, and I suspect that goes for quite a lot of people who filled in the form.

        Much as I loathe meta, I do have to admit they have a solid understanding of human psychology, and are pretty good at riding the boundary of the Overton window.

  6. Rich 2 Silver badge

    I don’t use faecesbook

    …. So how do I opt out of having any photos of me that may have been posted up on it by other people from being used? (And yes - I always ask that they do not post up any pics of me but I have no doubt that there are some anyway)

    1. ArguablyShrugs

      Re: I don’t use faecesbook

      There is a deeply buried contact form for GDPR issues that works for everybody, not just FB users:

      https://www.facebook.com/help/contact/540977946302970

      Select "DPO" and continue from there.

    2. hardboiledphil

      Re: I don’t use faecesbook

      How do they know its you if you don't have an account where they can learn your image?

      1. Alumoi Silver badge
        Joke

        Re: I don’t use faecesbook

        Duh, you'll have to supply state ID, including a photo.

  7. Barrie Shepherd

    Once you have logged into your facebook account open this page and you should be able to complete the form for opting out - assuming Meta accept you have a EU account.

    https://www.facebook.com/help/contact/6359191084165019

    Now does anyone know if this works for the whole Meta product range?

    1. Ball boy Silver badge
      Thumb Up

      One upvote for Barrie Shepherd for finding and posting the correct link to the opt out form. Thank you.

      (FWIW the page itself only mentions FB. I very much doubt it covers the entire Meta product set)

  8. mostly average
    Gimp

    Meta respects your right...

    ...to have questions and concerns about this policy.

  9. Infi 1

    Here's what I got when I clicked the 'right to object' link:

    Hi,

    Thank you for contacting us.

    For individuals who use their Meta account to access Meta Platforms Technologies Products (MPT Products: https://store.facebook.com/legal/quest/meta-platforms-technologies-products/), the Meta Privacy Policy and Supplemental Meta Platforms Technologies Privacy Policy apply to how we collect, use and share your information. Learn more about our legal bases and how they relate to the ways in which we process personal data here: (https://www.meta.com/ie/legal/quest/legal-bases/)

    Please note that the form you submitted is to make an objection request relating to your personal data under the relevant data protection laws.

    In order for us to review your report, we need to know:

    - What data processing you are opposing

    - How this processing affects you

    - Why you believe there was a violation of the relevant data protection laws, if applicable

    In addition, to learn more about downloading your information or permanently deleting your account, please visit the Meta Quest Privacy Centre: https://secure.oculus.com/my/privacy

    If you have another question or concern, please visit the Meta Quest Privacy FAQ (https://www.meta.com/help/quest/articles/accounts/privacy-information-and-settings/) or our Support Centre (https://support.oculus.com/) for additional information. If you have more questions about the Meta Privacy Policy (https://www.facebook.com/policy.php), or the Supplemental Meta Platforms Technologies Privacy Policy (https://www.meta.com/legal/quest/privacy-policy), please reply to this email.

    Thanks,

    Privacy Operations

  10. Anonymous Coward
    Anonymous Coward

    Non Europeans screwed

    Sigh wish there was a GDPR for the rest of the world. Meta isn't offering an opt out for those outside Europe.

    We're just feeding the machines that threaten our own creative output

    1. Badgerfruit

      Re: Non Europeans screwed

      Nobody is FORCING you to use their products. Delete your account. Done.

      Break the addiction and soon enough, you'll be happy you did.

      1. Anonymous Coward
        Anonymous Coward

        Re: Non Europeans screwed

        We're sure that deleted accounts won't be fed to the machine?

        1. Anonymous Coward
          Anonymous Coward

          Re: Non Europeans screwed

          Pollute the content before account deletion. Replace post contents with trash.

          1. Richard 12 Silver badge

            Re: Non Europeans screwed

            Which also won't work, because they'll still have the originals.

        2. Filippo Silver badge

          Re: Non Europeans screwed

          You're pretty much sure of the contrary, and there's nothing you can do about it. They already have the data, and you do not have the ability to delete it or modify it (any user-side action that looks like it's doing that will in reality only be affecting a current view).

          Quitting FB (and other invasive social media) will, however, prevent further damage.

  11. Anonymous Coward
    Anonymous Coward

    Meta’s AI follows the seagull model

    It eats any garbage it can find. The end result is probably not much different than that white stuff seagulls leave all over your car.

  12. Potemkine! Silver badge

    Ah, bad, bad European Union, preventing corporations to make business and make money. /s

    DPC seems a farce compared to the other 26 regulators. That's probably why megacorps try to deal with it exclusively. But, hey, that isn't enough, they still have to deal with the 26 other ones.

    1. Anonymous Coward
      Anonymous Coward

      The DPC is indeed a farce because the Irish government are in Big Tech's pocket. Aside from data protection, look at how Ireland is committing vast sums to its energy sector as a free giveaway to the data centre operators, how Ireland cooked up repeated sweetheart tax deals. I could be wrong, but I think that the country is playing a dangerous game. If either or both of the two big beasts of the EU decide they've had enough of regulation-dodging US tech companies, then it could all come crashing down. In some respects risking a repeat of the 2008 financial crisis, where Ireland was hit disproportionately hard. Whilst that looked like a home grown house price bubble, the Bank for International Settlements wrote in 2020 of the banking crisis in Ireland:

      "A key contributing factor was the relocation to Ireland of the international operations of multinational companies (Lane (2011)). These were attracted by competitive wages, language skills and membership of the European Union, which facilitated free movement of financial services and exports to the rest of the EU. Lower corporate taxes than in other EU countries also added significantly to the country’s appeal. With close to full employment reached by 2000, competitiveness started to diminish. The main source of growth became commercial and residential real estate transactions, fuelled by domestic lending and tax incentives, accompanied by increasing domestic income levels and migration flow."

  13. Anonymous Coward
    Anonymous Coward

    normal AI behaviour

    "Once the data has been entered into the models, there appears to be no option to scrub it."

    Yep, that's normal, once compiled into the model, it is part of it. You should remove it from the corpus first.

  14. Eguro
    Black Helicopters

    Clever girl... or boy as it were

    Any posts made on the platform to warn others about this change is sure to resemble the thousands of posts over the years of the sort below:

    "I DO NOT CONSENT TO LET FACEBOOK USE MY DATA! WITH THIS POST I AM REVOKING ANY PERMISSION. THIS MUST BE DONE BEFORE [date quite close to now]. COPY-PASTE THIS TEXT AND POST YOURSELF. DO NOT JUST SHARE."

    Meta found a way to put the training of many users to ignore these posts to their own use.

  15. MOH

    Sadly the Irish DPC isn't fit for purpose.

    1. Anonymous Coward
      Anonymous Coward

      Ireland is a democracy, if the population aren't happy with the situation they can change it.

      I'll wager that (a) most people don't understand the issue, (b) half of those who do don't care, (c) half of the remainder don't like it but will tolerate the situation by reason of net benefits to Ireland as the new Landing strip One for tech outfits. Which leaves circa 10% of the electorate understanding, caring and opposing. Now fractionate that 10% on political and tribal lines, ignore the percentage understand and care but will still support the incumbent government position due to broader political leanings, and you've got perhaps 3% of the population understanding, caring, and willing to vote as necessary to change government. How will that stack up against the Irish public's surveyed top priorities in declining order of healthcare, housing, economy, environment, each of which was nominated as a top priority by at least half of the electorate?

      1. TimMaher Silver badge
        Coat

        Time to boycott the DPC.

        And Meta of course.

        “Are you a goblin?

        No. I’ve just got a headache.”

        Mines the green one.

      2. jospanner

        Or maybe certain groups of people, ie corporations, have a disproportionate say over politics.

  16. Binraider Silver badge

    Training it on the ramblings of Lozza Fox and other lunatics. That'll end well.

  17. ArguablyShrugs

    How to opt‑out & object even without a FB account:

    General form for contacting Meta's DPO:

    https://www.facebook.com/help/contact/540977946302970

    dpo@meta.com (if it exists) might potentially work as well, untested.

  18. spold Silver badge

    A cunning move...

    ...by cats as part of their plan to take over the world. The AI training content will obviously be full of them.

    1. Anonymous Coward
      Anonymous Coward

      Re: A cunning move...

      Worse than that, it'll start generating images based on a combination of cat pics and human pics…

      I suppose the results might appeal to some furries, but, yeesh…

  19. heyrick Silver badge

    When will people wake up?

    AI, LLM, whatever you want to call it - it's snake oil with a side order of bollocks.

    Seriously, the sort of crap that gets spewed on social media, it's not an authoritative source (no, not even that one POTUS), nor is it verified beyond people dumb enough to pay a little extra for a mark to assuage their fragile egos...

    ...so what the hell is the point of training a bot on social media posts? Or are they trying to prove once and for all that "shit in equals shit out"? We already know, thanks.

  20. Zakspade

    What personal Data?

    Replied elsewhere regarding the whole thing being window dressing on the part of FB...

    However, why worry. I use FB. The ONLY correct thing held by Meta is my name. ALL of the data fields are populated with bogus data. Everything. Those who really know me will understand and know my real birthday isn't whatever FB 'accidentally' leaks. No one cares. I'm not enjoying a 'bromance' or in-depth relationship with those FB Friends I have never met in person - so they get whatever data FB gets - although I make no secret that ALL my personal data held by FB is false.

    So, if FB ignore their agreement to NOT use my data, who cares? What's that saying? Garbage in = garbage out...

  21. Iggle Piggle

    I'm trying to do the opt out thing now. They want my email address and say I need to confirm that by them sending a confirmation code. It has been many minutes now and no code has arrived. I'm betting the opt out page will expire first Grrrr

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like