After Meta recently rekindled its controversial plans to use public posts from UK Facebook and Instagram users as material for AI training, the social networking giant has taken the next step and will soon be sharing information again. We have started notifying local users that we are starting to offer .
The bad news is that the process Mehta devised to opt out of having this data for AI is almost as cumbersome as it was in the first place.
Read below for a breakdown of the latest changes and details on how to object…
“We are planning new AI features for you…”
The company started sending notifications about impending data retrievals last week, and like last time, the messages Meta displays informing users of how they plan to use the information will be along with other user alerts like friend requests and group updates. Posted on , it's easy to miss. (By comparison, for example, when Facebook encourages users to vote in an election, that message appears prominently at the top of the feed.)
The wording of the notice also suggests that users have no choice, with Meta simply promoting “new AI features for you” and allowing users to “Learn how we use your information.” It just says, “You can do that.'' Rather than explicitly informing users that they have the option to object to processing;
Additionally, even if users become aware of the notification, the process to dispute it is not easy. You have to go through multiple clicks and scrolls just to file a dispute. Meta also claims that it is at its discretion whether to honor this, which could further deter users from disputing efforts.
Facebook Notification Image credit: TechCrunch
“legitimate interest”
Meta has been supporting user-generated content for training AI in many markets for some time already. But Europe's comprehensive data protection framework, also known as GDPR, has created problems for social networking giants (and other tech giants) to do the same across the region.
Meta's argument is that local user-generated content is needed to improve large-scale language models, including public social media posts, comments, interactions, photos, etc., and that such access is It claims to help better reflect the diversity of the population. However, GDPR requires a valid legal basis for processing people's information to train AI.
Back in June, Meta was forced to pause plans to use European data for AI training after opposition from European Union and UK regulators. Watchdog groups were frustrated that people were being asked to opt out rather than actively consenting to this new use of their data.
Meta says it relies on a legal provision within the GDPR called “legitimate interest” (LI), which it suggests justifies not obtaining people's consent first. However, the use of the same legal basis to process personal data for microtargeted advertising operations was struck down by the Court of Justice of the European Union in a July 2023 ruling. Privacy experts argue that LI is similarly inappropriate for Meta to obtain people's data to train AI.
Given that Meta's UK operations are currently outside the jurisdiction of the EU, the company has nonetheless moved forward with its data training efforts in the UK and made only minor changes to the opt-out process it offers local users. It did this despite the UK's domestic data protection regulations still being based on the EU's GDPR. Additionally, we currently do not process data from EU users to train our AI.
I have an objection and respect it.
The main point of contention for UK users is that Meta makes it easy for people to object to their posts being used as material for AI training.
It's true that Meta's revised opt-out process resulted in slightly fewer clicks than the previous process, which prompted an objection from the UK Information Commissioner's Office (ICO). There's also less corporate jargon for people to sift through than there used to be. But the process of asking to opt out is still unnecessarily cumbersome.
The most important issues have not changed either. Meta only offers users an opt-out, not a free choice about how their data is used for AI training. In that case, users would have to actively “opt in” before their information is used, which is still not the case here. Unless you object, Meta assumes you will respect your objection and uses that information to train the AI.
So how do you disagree? When a user clicks on Meta's notice (assuming it's visible), they are taken to a page informing them of Meta's plans and that they have a “right to object” to this use of their information. You can also tell.
“If your objection is respected, we will no longer use your public information from Facebook and Instagram to develop and improve generative AI models for AI at Meta features and experiences.” is stated in the notice.
Facebook notification image credit: TechCrunch
If the user wants to object, he has to click on the hyperlinked word “Object” and an input form will appear.
The form is pre-populated with the email address associated with your account. One notable change here compared to Meta's previous opt-out is that the box asking users to explain how Meta's data processing affects them is now marked as “optional.” This is the marked point. On the other hand, when Meta tried to roll this out a few months ago, it required user input. to write something.
Facebook Dispute Form Image Credit: TechCrunch
Despite some tweaks, the revision process designed by Meta is still not strictly opt-out compliant. Although Meta has publicly claimed that it respects any objections, the language throughout the process states that it is at Meta's discretion.
Asked about this, Matt Pollard, Meta's spokesperson and policy communications manager, said in an email that the “if the dispute is accepted” language means that users must provide a valid email address associated with their account. He said this was because it needed to be submitted.
However, since submitting the form requires the user to log in to their Facebook account, and the email address field is pre-filled with the user's linked email address, what happens to an invalid email address? It is unknown whether it will be sent to Users had to manually edit email addresses that were already there.
Mr Pollard added: “There is no ambiguity here, it is very simple. We will respect all appeal forms that we receive.”
However, our testing shows that a valid email address is not actually required for a successful opt-out. You can enter any random string in the email address field and Meta will likely honor your request. When asked, Mr. Mehta said that although filling out this field is mandatory, the email address is actually only used if the user wants a “receipt” for a dispute. Ta.
So make it what you want.
Image credit: TechCrunch
“Illegal processing”?
Following Meta's revised notification process, some legal experts took to social media to argue that Meta may be incompatible with various aspects of the GDPR. Indeed, Dr Jennifer Cobb, assistant professor of law and technology at Queen's College, Cambridge, argued that this amounted to “unlawful processing”.
This is what I said – although the threat of filing a complaint with a regulator as toothless as the ICO is unlikely to change any company’s mind pic.twitter.com/BXj2lTC731
— Jennifer Cobbe (@jennifercobbe) October 2, 2024
One of the legal issues she highlights is that under the UK's GDPR, so-called “special category data” requires special protection due to its sensitivity. This is important. That's because sensitive characteristics such as a person's racial or ethnic origin, political opinions, beliefs, health information, and sexual orientation can easily be publicly communicated to friends on Facebook. Article 9 of the GDPR also explicitly states that the data subject (i.e. the Facebook user) must explicitly consent to the processing of special categories of data. That means you have to opt in.
So while Meta claims it has a “legitimate interest” in obtaining people's data and is moving ahead with data training plans in the UK, if users choose to lodge a formal complaint with the regulator. We may face new challenges.
When asked whether Meta's revised approach to processing people's data for AI meets standards, the ICO pointed TechCrunch to a previous statement released three weeks ago. In a statement, Executive Director of Regulatory Risk Stephen Almond said: “We will monitor the situation as Meta moves to notify users in the UK and begin processing in the coming weeks.” So if enough users complain about the smell, the ICO could be forced to take action.
At the time, Almond stressed that the ICO had not endorsed Meta's approach, adding that it was Meta's responsibility to “ensure and demonstrate ongoing compliance”.