Austria-based digital rights organization noyb has issued a formal cease and desist letter to Meta, challenging the company’s plan to train its AI models using user data from Facebook and Instagram accounts in the European Union. The move, set to begin on May 27, 2025, will apply all public posts and user interactions by default, unless users proactively opt out—a practice noyb argues violates the General Data Protection Regulation (GDPR).
At the heart of the dispute is Meta’s reliance on “legitimate interest” under Article 6(1)(f) of the GDPR, a clause traditionally reserved for actions like fraud prevention or employee management. Noyb claims Meta’s commercial objective of feeding user content into generative AI systems like Meta AI cannot justify bypassing user consent, especially given the difficulty of retrieving individual data from large language models (LLMs) after training.
Meta maintains that its AI practices align with European legal frameworks and cites guidance from the European Data Protection Board (EDPB). However, privacy activist Max Schrems, founder of noyb, argues that Meta has not received a green light from data protection authorities and is proceeding regardless of ongoing legal ambiguity. “Meta simply says that its interest in making money is more important than the rights of its users,” Schrems stated.
The legal challenge also raises broader concerns over AI data governance, particularly around the enforceability of rights like data deletion and access once information integrated into AI training sets. Meta’s previous attempt to launch AI training in the EU in 2024 paused due to similar regulatory concerns.
While national Data Protection Authorities remain largely silent, noyb is considering filing an injunction or class action. In the meantime, EU users are encouraged to opt out via Meta’s objection form to prevent their data from being used in AI training.
Source:
