Meta confirmed that it was pausing plans to begin training its AI systems with data from users in the European Union (EU) and the UK.
The move comes after a backlash from the Irish Data Protection Commission (DPC), Meta's lead regulator in the EU, which acts on behalf of multiple data protection authorities (DPAs) in the bloc. The UK Information Commissioner's Office (ICO) has also asked Meta to suspend its plans until the concerns it has raised are addressed.
“The DPC welcomes Meta's decision to suspend its plans to train large-scale language models using public content shared by adults on Facebook and Instagram across the EU/EEA,” the DPC said in a statement today. “The decision follows close consultation between the DPC and Meta. The DPC, in cooperation with other EU data protection authorities, will continue to consult with Meta on this issue.”
Meta already leverages user-generated content to train its AI in markets such as the U.S., but strict GDPR regulations in Europe pose an obstacle for Meta and other companies looking to use user-generated training material to improve their AI systems.
However, Meta began notifying users last month about upcoming changes to its privacy policy. The company said the changes would give it the right to train its AI using public content from Facebook and Instagram. This includes content from comments, business interactions, status updates, photos, and associated captions. The company argued that this was necessary to reflect the “diverse linguistic, geographical and cultural references of European peoples.”
These changes were set to come into effect 12 days from now, on June 26, 2024. However, following the plans, non-profit privacy activist group NOYB (“None of Your Business”) filed 11 complaints with EU member states, alleging that Meta violates various aspects of the GDPR, one of which concerns the issue of opt-in and opt-out, which states that when personal data processing takes place, users should first be asked for their permission, rather than being required to take action to opt out.
Meta, on the other hand, relied on the GDPR's “legitimate interest” clause to argue that its actions complied with the regulation. This is not the first time Meta has used this legal basis as a defence, having previously used it to justify processing the data of European users for targeted advertising.
It always seemed likely that regulators would at least suspend enforcement of Meta's planned changes, especially considering the company had made it difficult for users to “opt out” of its data use. The company said it sent more than 2 billion notifications informing users about the upcoming changes, but unlike other important public messages that are plastered to the top of users' feeds, such as urging them to go vote, these notifications appeared alongside users' standard notifications, such as friends' birthdays, photo tag alerts, and group announcements. So if you don't regularly check your notifications, it's very easy to miss this one.
And people who see the notice don't automatically know there's a way to object or opt out: the notice simply prompted users to click to find out how Meta uses their information — there was nothing there to suggest they had a choice.
Meta: AI Notifications Image Credit: Meta
Additionally, users technically could not “opt out” of having their data used. Instead, they had to fill out an objection form justifying why they wanted to opt out. Whether or not this request would be honored was entirely at Meta's discretion, but the company said it would honor each request.
While the appeal form was linked from the notification itself, anyone actively looking for the appeal form in their account settings had to click through six confusing separate links to get there, and the “right to appeal” link was located separately within 1,100 words of the Generator AI policy page.
Link to the “Right to Object” formImage credit: Meta / screenshot
In a blog post updated today, Stefano Fratta, Meta's global engagement director for privacy policy, said the company was “disappointed” with the demands it received from the DPC.
“This is a setback for European innovation and competition in AI development, further delaying the benefits of AI to Europeans,” Fratta wrote. “We are highly confident that our approach complies with European laws and regulations. AI training is not exclusive to our services, and we are more transparent than our industry peers.”