noyb sends Meta C&D demanding no EU user data AI training

There's a Max Schrems-shaped object standing in the way of Meta's plans to train its AI on the data of its European users, and he's come armed with several justifications for why Zuckercorp might be violating EU regulations with its stated plans. 

Noyb contends it's 'absurd' for Meta to argue it needs the personal data of every single user's post and comments from the past 20 years to adequately train its AI

The Austrian lawyer's noyb (None Of Your Business) privacy advocacy group sent a cease and desist letter to Meta Wednesday. Noyb's letter tells the Facebook giant that, if it opts not to discuss the matter or agree to make user data for AI data training an explicit opt-in, as opposed to the opt-out approach Meta is currently pursuing, Schrems and company are ready to file an injunction, or even take the matter to court in a class-action case. 

This isn't the first time noyb has challenged Meta on plans to train its AI on the public posts and comments of EU users, as we noted in our coverage last month when Meta announced plans to resume training its AI in the EU. 

In that instance, settled in June 2024, Meta agreed to pause EU/EEA AI training following 11 complaints from noyb to the Irish Data Protection Commission (DPC). The European Data Protection Board (EDPB) said in a December opinion requested by the DPC that there were appropriate ways to train AI on EU/EEA citizen social media data, but noyb's letter sent to Meta today makes clear it doesn't believe the company's latest attempt to reintroduce training collection complies with the EU's General Data Protection Regulation (GDPR).

Why noyb thinks Meta's still flouting compliance

The legal eagles' letter [PDF] to Meta argues the company's continued reliance on GDPR's "legitimate interest" exception to collecting data without explicit opt-in consent as allowed by Article 6(1) of the data protection law is incorrect, adding that it believes Meta has no legitimate interest which overrides the legislation's requirement that users need to explicitly opt in to give their consent.

To support its case, noyb argues Meta has already been told something similar with regards to collecting the data of its users to serve advertisements, which it previously did without an explicit opt-in on the same "legitimate interest" grounds. Meta agreed in 2023 to drop legitimate interest in favor of explicit consent for advertising following years of GDPR lawsuits. Noyb believes this is the exact same situation, only swapping ad targeting out for AI training. 

"The European Court of Justice has already held that Meta cannot claim a 'legitimate interest' in targeting users with advertising," Schrems said in a noyb statement. "How should it have a 'legitimate interest' to suck up all data for AI training?"

Meta has previously argued it needs to collect social media data for AI training in order to make its AI models culturally aware. Were Meta to make AI training data collection an opt-in feature and get just 10 percent of its 400 million monthly active users in the EU to consent, noyb countered, "such training would already clearly be sufficient to learn EU languages and alike." 

Noyb contends it is "absurd" for Meta to argue it needs the personal data of every single user's post and comments from the past 20 years to adequately train its AI. 

"Most other AI providers (like OpenAI or French Mistral) have zero access to social media data and still outcompete Meta's AI systems," noyb said, being sure to get a burn in with its reasoning.

• Meta faces multiple complaints in Europe over plans to train AI on user data
• Meta bets you want a sprinkle of social in your chatbot
• Privacy warriors gripe to UK watchdog about Meta harvesting user data to train AI
• Meta blames Trump tariffs for ballooning AI infra bills

Meta contends otherwise, naturally. A company spokesperson told The Register it believes its approach clearly complies with EDPB guidance.

"Noyb's copycat actions are part of an attempt by a vocal minority of activist groups to delay AI innovation in the EU, which is ultimately harming consumers and businesses who could benefit from these cutting-edge technologies," Meta told us.

The company further reads the December opinion from the EDPB completely differently from noyb, arguing the document validated its use of legitimate interest to harvest the data without an explicit opt-in. Meta further claimed it's not the only AI company using legitimate interest to process EU citizens' data for AI training, and declared its method to be more transparent than its competitors. 

Given Meta's response, it seems likely this matter will end up in court.

"We are currently evaluating our options to file injunctions, but there is also the option for a subsequent class action for non-material damages," Schrems noted. Noyb estimates that, were it to file a class-action redress lawsuit, Meta could be on the hook for more than €200 billion ($224B), assuming €500 in non-material damages per each EU monthly active user. 

Additionally, noyb said other ground in the EU are also reviewing their options for litigation to stop Meta's AI data collection, and expects individual European citizens will likely take action as well. 

"We are very surprised that Meta would take this risk just to avoid asking users for their consent," Schrems said. "Even just managing this litigation will be a huge task for Meta." ®