Meta wants to train its own AI models with your data

An Uncomfortable reminder from Meta

Meta has a long history of testing the waters on how much they can leverage users' data before anything says stop.

So far this has worked very well for the company, as they have the ability to move much faster than regulations and oversight manage to keep up. The same now applies to AI and training AI models.

‍

Wants to train own AI model on user data from Facebook and Instagram

Meta wants to use public posts and images to build datasets for their AI training, it emerges in their updated privacy policy. Currently, this applies as of 26. June.

This is not the first time companies rush into the new big thing that will wow investors. Big Data is out. AI is the latest gold rush, and Meta doesn't want to be lagging behind the other tech companies. It's understandable, but a lot of people don't agree with how this is being implemented by Meta.

‍

‍

Meta has self-moderated to use only data from public posts and images. And personal data from accounts of users under the age of 18 is supposedly not used.
Here, there's some grey area about what happens to photos you self-publish that contain someone under 18. My own opinion is that images that are flagged as containing children will not be used.

‍

The Nordic data protection authorities are also recently working on the framework on how children's privacy can be safeguarded.

Nordic cooperation on children's privacy in games, KI and infringement fees

Article, Norwegian Data Protection Authority.

‍

Is this allowed? What is the legal basis

Meta has considered their use of personal data for training AI models to be of legitimate interest. That is, they have considered that their interest weighs more heavily than the interests and rights of users. Read more about interest trade-off at the Norwegian Data Protection Authority.

This is a very practical consideration for Meta, as this basis does not require consent for this use of personal data.

‍

We receive a lot of questions about the legality of this. The answer is that it's doubtful.
In our view, the most natural thing would have been to ask users for consent before their posts and images are used in this way.

-Trine Smedbold, Senior Legal Adviser, Norwegian Data Protection Authority.

‍

A gray zone

AI remains a gray area for both privacy and law enforcement. The EU wants a comprehensive Legislation for AI, but companies don't plan to wait until this is clarified, and are testing the waters while they can.

‍

The Norwegian Data has already received complaints about the upcoming practice, including a joint complaint from the Norwegian Consumer Council and the interest organisation noyb.

Article, Norwegian Data Protection Authority.

‍
In the meantime, it is vital that regulators in the EU are quick to carry out assessments to plug gaps like just this one. There are no previous cases to refer to when it comes to the use of personal data for training AI models, so this requires it's own assessment by data regulators.

‍

We take the complaint seriously and give it a high priority. We will work closely with our European colleagues in the further handling of the case,”

-Line Coll, director of Norwegian Data Protection Authority.

‍

The assessment will likely be that Meta will have to reconsider the legal basis and receive a specific consent for the use of personal data for training AI models.
Specific consent is often managed through consent banners, commonly known as cookie banners.

‍

‍

What can you do?

As a consumer, what choices do you have?

If you do not want your posts and images to be used to train Meta's AI models, you can use the right to protest. Read more about your rights at Norwegian Data Protection Authority.

Meta has set up forms to handle these protests, you can find them here:

• Facebook protest form
• Protest form for Instagram

‍

Several people have pointed out error messages when opening the links to the form. If you receive an error message, you must log in to the account in the same browser in which you open the links and select your personal account in advance.

‍

‍

The Norwegian Data Protection Authority has tested the form, and which was accepted within seconds. This suggests that Meta has a low threshold for accepting protests.

‍

Is my protest going to amount to anything?

Perhaps. That is, among other things, up to Meta's assessment of how much damage it can do to their brand, versus the value of having their own AI model. If we look at Meta's handling of personal data in general, I don't have that much faith this in itself will constitute change.
In which case, it will be up to regulators assesments and enforcement of that assessment.

‍

Other possibilities

You can do as AI-expert Inga Strümke and delete your Facebook account.

KI expert: -- Now I'm deleting Facebook

-article, tv2.no

‍

Some users have also taken to changing their profile or posts as not visible to the public. It's unclear whether it is enough setting them to “friends” or whether you actually have to limit them to “only me”.
Either way, this is based on Meta's own self-limitation, so you have no guarantee that it will stay that way in the future.

‍