As of May 27, 2025, Meta (Facebook and Instagram) will start using some of the personal data of European users to train its artificial intelligence (AI) systems, including tools such as Meta AI and Llama language models.
Meta initially announced this initiative in 2024 but paused its implementation following discussions with the Irish Data Protection Commission (DPC), which raised concerns about the legal basis and transparency of the proposed data use. The General Data Protection Regulation (GDPR), which was adopted by the European Union in 2016, has indeed led to more stringent regulations surrounding the use of user data for the training of artificial intelligence (AI) systems by technology companies such as Meta.
Nevertheless, in order to develop its AI systems, for which optimal functionality is contingent upon comprehensive training and the utilization of a precise dataset, Meta was compelled to reach a compromise. This entailed the provision of an opt-out option for users for every account they have on the platforms and even for users who do not have an account.
What Data Will Be Used?
Meta plans to use both past and future data from adult users of Facebook and Instagram, including:
- Public posts (text, images, comments) made by adult users.
- Data from interactions with Meta's AI services, such as chat inputs in AI-powered tools, regardless of user age.
The Objection of Data Use
As Meta stated in the communication campaign that was sent to its users, objections to this data use can be made without having to provide any justification. Objections can be submitted by:
- Adjusting privacy settings to prevent content from being public.
- Filling out an opt-out form, available now for both platforms:
This opt-out only covers content that the users have personally published. It does not apply to content where they appear but was posted by another user. However, Meta also provides a non-logged-in opt-out form, the Non-User Opt-Out Form for:
- Individuals without a Meta account, or
- To object to data processing for content shared about them by others:
Regulatory Oversight and Concerns
European data protection authorities are actively reviewing the legality of Meta's planned data use, including:
- Whether the use of legitimate interest is an appropriate legal basis.
- The effectiveness of the opt-out process.
- Whether the original purpose of data collection aligns with AI training.
- How data from or about minors is being handled.
Indeed, the primary concern regarding the efficacy of data privacy rights in the context of artificial intelligence (AI) pertains to the issue of irreversibility. While the right to object can be exercised at any point in time, once data has been utilized to train AI, the AI becomes inherently constrained and cannot "unlearn" the information it has been programmed with. This underscores the necessity for Meta to proactively engage in awareness-raising initiatives, such as the aforementioned communication campaign, with the aim of empowering users to exercise control over the utilization of their data for training AI systems prior to May 27, 2025.
Next Steps for Users and Businesses
- Stay alert for Meta's updated privacy policy (expected by late May).
- Review your or your organization's Meta account settings.
- Consider submitting opt-out forms if AI data use is a concern.
- Monitor developments from EU regulators for potential changes in Meta's obligations.
How Goodwin Can Help
Goodwin's Technology and Regulatory team in Luxembourg is advising clients on the practical and legal implications of AI deployment and data protection compliance under EU law, including the GDPR and emerging regulatory standards. We provide strategic and operational support throughout the AI lifecycle, including:
- Assessment of AI systems and data processing activities under GDPR and other applicable regulations;
- Design and implementation of AI governance frameworks, including risk assessments, transparency obligations, and data minimisation strategies;
- Guidance on lawful bases for data use in AI training, including legitimate interest assessments and user consent mechanisms;
- Support in regulatory engagement, including responses to data protection authorities and cross-border coordination;
- Representation in enforcement proceedings, audits, or investigations related to AI and data protection.
We would like to thank Lauréline Decottignies for her assistance with this insight.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
