Meta confirmed that it was pausing plans to begin training its AI systems with data from users in the European Union and the UK.
The move comes after a backlash from the Irish Data Protection Commission (DPC), Meta's lead regulator in the EU, which acts on behalf of multiple data protection authorities across the bloc. The UK Information Commissioner's Office (ICO) has also asked Meta to suspend its plans until concerns it has raised are addressed.
“The DPC welcomes Meta's decision to suspend its plans to train large-scale language models using public content shared by adults on Facebook and Instagram across the EU/EEA,” the DPC said in a statement on Friday. “The decision follows intensive consultation between the DPC and Meta. The DPC, in cooperation with other EU data protection authorities, will continue to consult with Meta on this issue.”
While Meta already uses user-generated content to train its AI in markets such as the U.S., strict GDPR regulations in Europe pose an obstacle for Meta and other companies looking to improve their AI systems, such as large-scale language models with user-generated training material.
However, Meta began notifying users last month about upcoming changes to its privacy policy. The company said the changes would give it the right to use public Facebook and Instagram content, including comments, interactions with businesses, status updates, photos, and related captions, to train its AI. The company argued that this was necessary to reflect the “diverse linguistic, geographical and cultural references of European peoples.”
These changes were set to come into effect 12 days from now, on June 26. However, the plans have spurred non-profit privacy activist group NOYB (“None of Your Business”) to file 11 complaints with EU member states alleging that Meta violates various aspects of the GDPR, one of which concerns the opt-in/opt-out issue. for When processing personal data, you should first ask the user for permission rather than requiring them to take action to opt out.
Meta, on the other hand, had argued that its actions complied with the regulation, relying on the GDPR's “legitimate interest” clause. This is not the first time Meta has used this legal basis as a defence, having previously used it to justify processing European users' information for targeted advertising.
It always seemed likely that regulators would at least suspend enforcement of Meta's planned changes, especially given how difficult the company had made it for users to “opt out” of its data use. The company said it sent more than 2 billion notifications informing users about the upcoming changes, but unlike other important public messages that are plastered to the top of users' feeds, such as urging them to go vote, these notifications appeared alongside users' standard notifications, like friend birthdays, photo tag alerts, and group announcements. That made it very easy for people who don't regularly check their notifications to miss this one.
And people who see the notice don't automatically know there's a way to object or opt out: the notice simply prompted users to click to find out how Meta uses their information — there was nothing to suggest there was a choice here.
Additionally, users technically could not “opt out” of the use of their data. Instead, they had to fill out an objection form justifying why they did not want their data to be processed. Whether or not this request would be honored was entirely at Meta's discretion, but the company said it would honor each request.
While the dispute form was linked from the notification itself, it was a pain for anyone actively searching for it in their account settings.
On the Facebook website, first Profile photo Top right Settings and Privacy; Tap Privacy Center; Scroll down and click Generative AI in Meta section; Scroll down again past the many links and you will see Additional ResourcesThe first link in this section was titled “How Meta uses information for its Generative AI models,” and I had to read about 1,100 words before I got to a separate link to the company's “right to object” form. It was a similar story with Facebook's mobile apps.
When asked earlier this week why the process requires users to object rather than opt in, Meta policy communications manager Matt Pollard pointed TechCrunch to an existing blog post, saying: “We believe in the legal basis for this. [“legitimate interests”] “It strikes the right balance between respecting people's rights while still processing public data at the scale necessary to train AI models.”
In other words, this opt-in likely wouldn't generate enough “scale” in terms of the number of people willing to provide their data, so the best way around this was to put a single notification among users' other notifications, with a hidden objection form after 6 clicks for anyone wanting to “opt out” independently, and have them justify their objection rather than opt out directly.
In a blog post updated on Friday, Stefano Fratta, Meta's global engagement director for privacy policies, said he was “disappointed” with the request he received from the DPC.
“This is a setback for European innovation and competition in AI development, further delaying the benefits of AI to Europeans,” Fratta wrote. “We are highly confident that our approach complies with European laws and regulations. AI training is not exclusive to our services, and we are more transparent than our industry peers.”
The AI Arms Race
None of this is new, and Meta is entering an AI arms race that has shone a spotlight on the vast amounts of data Big Tech holds on all of us.
Earlier this year, Reddit revealed it had a deal to make more than $200 million over the next few years by licensing its data to companies like ChatGPT developer OpenAI and Google, which is already facing a huge fine for using copyrighted news content to train a generative AI model.
But these efforts highlight the lengths to which companies will go to ensure they can use this data within the constraints of existing laws. “Opt-in” is rarely on the table, and opt-out processes are often unnecessarily cumbersome. Last month, Slack's existing privacy policy was found to contain questionable language suggesting that user data could be used to train AI systems, and that the only way users could opt out was to email the company.
And last year, Google finally gave online publishers the ability to allow their websites to opt out of being trained on Google’s models by inserting code into their sites. OpenAI is building a dedicated tool, due to be ready by 2025, that will allow content creators to opt out of being trained on generative AI smarts.
Meta’s attempts to train its AI on European users’ public content have been halted for now, but will likely rear their head again in a different guise after consultations with the DPC and ICO, hopefully with a different user permission process.
“To make the most of generative AI and the opportunities it brings, it is vital that the public can trust that their privacy rights will be respected from the outset,” Stephen Almond, the ICO's executive director of regulatory risk, said in a statement on Friday. “We will continue to monitor leading developers of generative AI, including Meta, and review the safeguards they have put in place to ensure that the information rights of UK users are protected.”
