Meta faces multiple complaints in Europe over plans to train AI on user data Meta's plans to use customer data in AI training have resulted in complaints to data protection authorities in 11 European countries. The complaints were filed by privacy activist group noyb following updates to Meta's privacy policy. The updates are due to take effect worldwide on June 26. The main issue, according to noyb, …
A spokesperson for Meta told The Register: "We are confident that our approach complies with privacy laws, and our approach is consistent with how other tech companies are developing and improving their AI experiences in Europe."
For starters, requiring you to opt-out of your data being processed is a GDPR no-no. I managed to do so, and they didn't make it easy - click on a non-obvious link in the middle of the "changes to terms" notification they send you (mixed in with your other notifications), and then fill in a form (including submitting and verifying your email address) giving them your grounds for objecting. I told them it was on the grounds of violation of my privacy, and they responded that I had been opted out "successfully", but I should not have had to do this. It seems like a clear GDPR violation to me.
Same here. Took a couple of attempts (link took me to a Holding Page telling me something was broken, before later in the day finally allowing me to lodge my objection).
The thing is: how do I know that FB doesn't ignore me - despite their email telling me that my APPLICATION to opt-out has been accepted and will be acted upon? Exactly - zero way to know and I very strongly suspect the "opt-out" is merely 'window dressing' and PR. Had they looked at it as a serious thing with proper intent, FB would have realised that the very fact of having to opt OUT rather than being asked to opt IN breaks the very laws they claim to be adhering to...
Rather than "delete" it, I thought maybe some day I might want to use it.. So I no longer get emails from them and I have never accepted any updated terms.. Nor do I have any means to specifically "opt out".
What is the law's position on Meta using deactivated account data to train AI, from users who have never consented to such use?
Simple - it is illegal<period>
So they'll go ahead and do it anyway.
If i were a user I would be very tempted to put some very specific stuff (e.g. some random text strings) in my account so that later I could do a search for those strings and see what comes up. That way, if the search returned those unique strings despite me having opted out, I could demand they delete my data. I could imagine the exchange :
Me: Delete my data as required by law.
FB: We can't it's embedded in teh AI model and can't be deleted without deleting the whole model.
Me: So, you still have to delete my data.
I conjecture from your comment "giving them your grounds for objecting" that the lawful basis for processing being relied on is Legitimate Interest (Article 6.1(f)), as the requirement to give grounds that you state applies to the Right to Object under Article 21. Consequently, consent is irrelevant as it is not the lawful basis in this case. The common assumption that consent tops the list of lawful bases is incorrect. Properly applied, it is probably one of the least useful lawful bases, and it certainly doesn't exist as a super-layer over the others. So it's equally fallacious that data subjects can invoke consent as a universal means of objecting to processing regardless of the lawful basis that applies, but the chief source of this confusion has always been the paucity of information from these behemoth data controllers about the lawful bases relied on for specific processing.
What is Meta's legitimate interest in my personal data? I have no relationship with them as a legitimate processor of my data, and no agreement (beyond the T&Cs of Facebook) with them to do anything at all with my data. Just because they had my data before GDPR existed does not mean they are not bound by it.
AFAIK "legitimate interest" means usage by organisations that have a statutory requirement to hold that data, such as public service organisations, of which Meta definitely isn't one.
In other words, for "legitimate interest" to apply, Meta must pass the "three part test":
Purpose test – is there a legitimate interest behind the processing?
Necessity test – is the processing necessary for that purpose?
Balancing test – is the legitimate interest overridden by the individual’s interests, rights or freedoms?
I think it's pretty clear that any "legitimate interest" claim fails on the balancing test, in that it is clearly not in my interests for my personal information to be freely collected, analysed, and sold, for profit, without any oversight from myself.
"I think it's pretty clear that any "legitimate interest" claim fails on the balancing test"
Unfortunately this is a weakness of the legislation, in that the balancing test is performed by the party interested in conducting the processing. There is a statutory right to challenge the decision, but you can only do this [a] if you can gain access to the documentation and [b] if you can afford to take the data controller to court. In the UK at least, single complaints about such things attract no serious response.
Oh and BTW, '"legitimate interest" means usage by organisations that have a statutory requirement to hold that data' is not correct. Any organisation can declare pretty much any processing to be in its (or a 3rd party's) legitimate interest unless it involves processing of the protected categories of data (which expressly require consent). It would then be up to data subjects to get the regulator to challenge it or challenge it themselves. Which is why this basis has been so widely abused.
Any organisation can declare pretty much any processing to be in its (or a 3rd party's) legitimate interest, unless it involves processing of the protected categories of data
Whilst this is true, I'm of the opinion that unless an organisation has to process my data, then merely wanting to for profit, isn't really legitimate. My own interests in having them not do this overrides their interest in making money off my back, and they should therefore have an explicit opt-in, if they want to do this.
All my social media stuff is 'Public' anyway.
But who would trust or pay a penny for any 'AI' based on social media? The quality of AI depends in great part upon its source material. Even most news content will be out of date and culturally questionable. Social media content is one step up from 4chan. They are creating a product that no sane person would use. Probably because the idea came from the top and nobody in the room had the balls to point this out.
Excellent question. I think that answer lies in the fact that 98% of actual language usage is oriented towards social bonding, not about debate or logical processing of facts. Facebook is an excellent place to extract data concerned with use of language for social bonding. It will be helpful for building bots that can hold unique one-on-one conversations for such goals as sales, fraud, political indoctrination and monitoring. While that maybe parasitic and unhelpful to mankind, it am certain it will be one giant leap for profitability.
The AI creators say their model doesn't keep the original text, so they argue they're not breaking copyright rules. But in reality, the model does hold onto a version of the original data.
For example, imagine I make a list of every word in a book and where it appears. Then I sell this list, claiming I'm not breaking copyright. However, someone using an algorithm, could use this list to recreate the original text.
Yes you could make such a list of a book, and that would not break copyright. If however you describe the algorithm required to reconstruct, that would break copyright. We know this, because what you are describing is just gzipping a book with lossless compression, and selling it, which was ruled copyright breach decades ago.
So the next question is, are LLMs equivalent to lossless compression. And the answer is, no they aren’t, which we can see trivially from this: LLM parameter sets are a few GB, out of the tens of petabytes they are trained on. So they cannot possibly store and reconstruct their inputs faithfully. LLMs do not violate copyright of the written word.
There are many other angles, but this isn’t it. For example, MidJourney et al *do* violate copyright on artists images routinely, but that’s different.
You claim in the same post, that what you are describing is just gzipping a book with lossless compression and also LLM parameter sets are a few GB, out of the tens of petabytes they are trained on. This doesn't actually demonstrate whether this is lossless compression, or not. Tens of petabytes of written material might well compress down to that size, in a lossless fashion, given the right algorithm.
In any case, whether it is lossless or not is a bit of a red herring. I could reproduce a grainy and lossy JPEG version of the "golden arches" and stick it on the front of a burger joint, and still expect to get sued out of existence by McDonalds. I think the actual test in law (and of course, IANAL) would be more around whether a reproduction retains the essence of the original.
“ I could reproduce a grainy and lossy JPEG version of the "golden arches" and stick it on the front of a burger joint, and still expect to get sued out of existence by McDonalds.”
Yes indeed. And this is exactly why I try to explain the laws that apply, because they aren’t what people think they are:
First off; the Golden Arches will be protected as a *trademark* not copyright, and that’s a separate set of conditions. But if a company made a graphic design that wasn’t a logo, they can register that under *design rights*, a different thing again. Now, if it’s an artistic picture, or a photo; that is *copyright*, but it’s a different sort of copyright. It’s literally a different set of pages in the legal code to text, some are the same rules and some are different.
Copyright of eg a painting, has only to be *similar* not the same, and “intent to deceive” is relevant, as is whether or not you actually used the original to copy (irrespective of the end result).
Text has to be both *the same*, substantial passages, and have substantial artistic invention and be uniquely identifiable as the work of the originator. Even a page copied directly out of a manual describing how to put together a particular piece of IKEA furniture is not going to be defensible copyright, because there’s only one way to do it, and everyone would describe it similarly. No artistic endeavour, no copyright. Essence of the original is also irrelevant: if you paraphrase, you do not infringe copyright.
TLDR: people’s experience of when copyright has teeth is almost always music, performances, or photos. Copyright of text is a different law, much weaker
@Justthefacts "Text has to be both *the same*, substantial passages, and have substantial artistic invention and be uniquely identifiable as the work of the originator. Even a page copied directly out of a manual describing how to put together a particular piece of IKEA furniture is not going to be defensible copyright, because there’s only one way to do it, and everyone would describe it similarly. No artistic endeavour, no copyright. Essence of the original is also irrelevant: if you paraphrase, you do not infringe copyright."
By uniquely identifiable I assume you mean it can't possible be anything other than a copy, then that's the only bit you got right. There has to be substantial passages of the same text, not necessarily. You can't take a published book and translate into another language and publish the translation.
Therefore essence of the original is relevant, how relevant is dictated by the size of the essence. The closer the resemblance is to an already published work the more likely the copyright owner can successfully sue for copyright infringement.
Substantial artistic invention! Non fiction is copyrightable, yes even manuals. Instead of IKEA let's take a manual that is published and sold, e.g. a Haynes workshop manual. Copy a page and stick it on the web, that is copyright infringement. Of course it will probably take more than a single page for the publishers go after you.
But copy the whole manual they will and if they can prove you put it on the web they will certainly be able to successfully sue you for copyright infringement. A manual just tells you how to do things, that's hardly substantial artistic invention.
I've gone through their right to object process, which is pretty deeply buried. You have to provide a reason why you do not want them to use your data, which they will then consider, and may reject. What are the odds that every objection is somehow overturned?
Largely the same here, but the confirmation was pretty much instant for me.
Had the request been denied I'd have had no hesitation in deleting the account, and I suspect that goes for quite a lot of people who filled in the form.
Much as I loathe meta, I do have to admit they have a solid understanding of human psychology, and are pretty good at riding the boundary of the Overton window.
Once you have logged into your facebook account open this page and you should be able to complete the form for opting out - assuming Meta accept you have a EU account.
https://www.facebook.com/help/contact/6359191084165019
Now does anyone know if this works for the whole Meta product range?
Here's what I got when I clicked the 'right to object' link:
Hi,
Thank you for contacting us.
For individuals who use their Meta account to access Meta Platforms Technologies Products (MPT Products: https://store.facebook.com/legal/quest/meta-platforms-technologies-products/), the Meta Privacy Policy and Supplemental Meta Platforms Technologies Privacy Policy apply to how we collect, use and share your information. Learn more about our legal bases and how they relate to the ways in which we process personal data here: (https://www.meta.com/ie/legal/quest/legal-bases/)
Please note that the form you submitted is to make an objection request relating to your personal data under the relevant data protection laws.
In order for us to review your report, we need to know:
- What data processing you are opposing
- How this processing affects you
- Why you believe there was a violation of the relevant data protection laws, if applicable
In addition, to learn more about downloading your information or permanently deleting your account, please visit the Meta Quest Privacy Centre: https://secure.oculus.com/my/privacy
If you have another question or concern, please visit the Meta Quest Privacy FAQ (https://www.meta.com/help/quest/articles/accounts/privacy-information-and-settings/) or our Support Centre (https://support.oculus.com/) for additional information. If you have more questions about the Meta Privacy Policy (https://www.facebook.com/policy.php), or the Supplemental Meta Platforms Technologies Privacy Policy (https://www.meta.com/legal/quest/privacy-policy), please reply to this email.
Thanks,
Privacy Operations
You're pretty much sure of the contrary, and there's nothing you can do about it. They already have the data, and you do not have the ability to delete it or modify it (any user-side action that looks like it's doing that will in reality only be affecting a current view).
Quitting FB (and other invasive social media) will, however, prevent further damage.
The DPC is indeed a farce because the Irish government are in Big Tech's pocket. Aside from data protection, look at how Ireland is committing vast sums to its energy sector as a free giveaway to the data centre operators, how Ireland cooked up repeated sweetheart tax deals. I could be wrong, but I think that the country is playing a dangerous game. If either or both of the two big beasts of the EU decide they've had enough of regulation-dodging US tech companies, then it could all come crashing down. In some respects risking a repeat of the 2008 financial crisis, where Ireland was hit disproportionately hard. Whilst that looked like a home grown house price bubble, the Bank for International Settlements wrote in 2020 of the banking crisis in Ireland:
"A key contributing factor was the relocation to Ireland of the international operations of multinational companies (Lane (2011)). These were attracted by competitive wages, language skills and membership of the European Union, which facilitated free movement of financial services and exports to the rest of the EU. Lower corporate taxes than in other EU countries also added significantly to the country’s appeal. With close to full employment reached by 2000, competitiveness started to diminish. The main source of growth became commercial and residential real estate transactions, fuelled by domestic lending and tax incentives, accompanied by increasing domestic income levels and migration flow."
Any posts made on the platform to warn others about this change is sure to resemble the thousands of posts over the years of the sort below:
"I DO NOT CONSENT TO LET FACEBOOK USE MY DATA! WITH THIS POST I AM REVOKING ANY PERMISSION. THIS MUST BE DONE BEFORE [date quite close to now]. COPY-PASTE THIS TEXT AND POST YOURSELF. DO NOT JUST SHARE."
Meta found a way to put the training of many users to ignore these posts to their own use.
Ireland is a democracy, if the population aren't happy with the situation they can change it.
I'll wager that (a) most people don't understand the issue, (b) half of those who do don't care, (c) half of the remainder don't like it but will tolerate the situation by reason of net benefits to Ireland as the new Landing strip One for tech outfits. Which leaves circa 10% of the electorate understanding, caring and opposing. Now fractionate that 10% on political and tribal lines, ignore the percentage understand and care but will still support the incumbent government position due to broader political leanings, and you've got perhaps 3% of the population understanding, caring, and willing to vote as necessary to change government. How will that stack up against the Irish public's surveyed top priorities in declining order of healthcare, housing, economy, environment, each of which was nominated as a top priority by at least half of the electorate?
AI, LLM, whatever you want to call it - it's snake oil with a side order of bollocks.
Seriously, the sort of crap that gets spewed on social media, it's not an authoritative source (no, not even that one POTUS), nor is it verified beyond people dumb enough to pay a little extra for a mark to assuage their fragile egos...
...so what the hell is the point of training a bot on social media posts? Or are they trying to prove once and for all that "shit in equals shit out"? We already know, thanks.
Replied elsewhere regarding the whole thing being window dressing on the part of FB...
However, why worry. I use FB. The ONLY correct thing held by Meta is my name. ALL of the data fields are populated with bogus data. Everything. Those who really know me will understand and know my real birthday isn't whatever FB 'accidentally' leaks. No one cares. I'm not enjoying a 'bromance' or in-depth relationship with those FB Friends I have never met in person - so they get whatever data FB gets - although I make no secret that ALL my personal data held by FB is false.
So, if FB ignore their agreement to NOT use my data, who cares? What's that saying? Garbage in = garbage out...
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
