After Meta recently reignited controversial plans to use the public posts of U.K. Facebook and Instagram users’ as AI training fodder, the social networking giant has taken the next step and begun to notify local users it will soon start helping itself to their information again.
The bad news is the process Meta has devised for opting out of this data-for-AI grab is almost as onerous as it was first time around.
Read on for a break down of the latest changes and details on how to object…
‘We’re planning new AI features for you…’
The company began sending out notifications about the impending data grab last week and, much like last time, the message Meta displays informing users of its planned use of their information is posted alongside other user alerts, such as friend requests and group updates, making it easy to miss. (By comparison, when Facebook prompts users to vote in an election, for example, the messaging is plastered prominently at the top of the feed.)
The phrasing of the notification also implies users don’t have a choice, with Meta merely touting “new AI features for you” and writing that users can: “Learn how we use your information.” Rather than explicitly informing people they have a choice to deny the processing.
Moreover, even if the user does spot the notification, the process to object is not simple; they must engage in multiple clicks and scrolls just to file an objection. Meta also claims it is at their discretion whether they honor it, which could further dissuade users from going through the effort of filing an objection.
‘Legitimate interest’
Meta has been helping itself to user-generated content to train its AI in many markets for some time already. But Europe’s comprehensive data protection framework, aka the GDPR, has created issues for the social networking giant (and other tech giants) from doing the same around the region.
Meta’s argument is that it needs local user-generated content to improve its large language models, including public social media posts, comments, interactions, photos and more — and it claims such access will help it better reflect the diversity of the European population. However, the GDPR requires that it has a valid legal basis for processing people’s information to train AIs.
Back in June, Meta was forced to pause its plans to use Europeans’ data for AI training after objections from European Union and U.K. regulators. The watchdogs were unhappy that people were being asked to opt-out, rather than affirmatively agree, to this new use of their data.
Meta has said it’s relying on a legal provision within the GDPR called “legitimate interests” (LI) — which it suggests justifies not obtaining people’s consent first. But its use of the same legal basis for processing personal data for its micro-targeted advertising business was struck down by the Court of Justice of the European Union in a July 2023 ruling. Privacy experts argue LI is similarly inappropriate for Meta to grab people’s data for training AIs.
Given that Meta’s U.K. business now sits outside the EU’s jurisdiction, the company has — nonetheless — forged ahead with its data-training endeavors in the U.K., making only minor changes to the opt-out process it offers local users. It has done this is in spite of the U.K.’s domestic data protection rules still being based on the EU’s GDPR. It is also not currently processing EU users’ data for training AIs.
Objection, your honor
A major bone of contention for U.K. users is that Meta is not making it easy for people to object to their posts becoming AI training fodder.
It’s true that Meta’s revised opt out process requires slightly fewer clicks than the earlier one which triggered objections from the U.K.’s Information Commissioner’s Office (ICO). There is also less corporate lingo for people to sift through, compared to before. But the process of asking to opt out is still far more onerous than it needs to be.
The overriding issue also hasn’t changed: Meta is only offering users an opt-out, rather than giving them a free choice over use of their data for AI training. If it did that, users would need to affirmatively “opt in” before it could use their information and that’s still not the case here. Unless the user objects, Meta will be using their information to train its AI — assuming it does honor the objection.
So how do you object? Once the user clicks on Meta’s notification (assuming they see it), they’re taken to a page that informs them of Meta’s plans, and also tells them they have the “right to object” to this use of their information.
“If your objection is honoured, from then on, we won’t use your public information from Facebook and Instagram to develop and improve generative AI models for our AI at Meta features and experiences,” the notification states.
If the user wishes to object, they must click on the hyperlinked word “object,” and are then taken to a form to complete.
The form is pre-populated with the email address associated with the user’s account. One notable change here versus Meta’s last opt-out is that a box asking the user to explain how Meta’s data processing impacts them has been marked as “optional” — whereas when Meta tried to roll this out a few months back, the user was required to write something.
Despite a few tweaks, the revised process Meta has designed still does not conform to a strict opt-out, either — while Meta has publicly claimed that it will honor every objection, the wording throughout the process states that it’s at Meta’s discretion.
Asked about this, Meta spokesperson, policy communications manager Matt Pollard, said in an email that the language around the whole “if the objection is honored” bit, is due to its requirement that users submit a valid email address connected to their account.
However, the user needs to be logged in to their Facebook account in order to submit the form, and the email address field is pre-populated with the user’s linked email address, so it’s not clear how an invalid email address would be submitted unless the user was to manually edit their email address that’s already in there.
“There’s no ambiguity here at all, it’s very straightforward — we will honour all objection forms received,” Pollard added.
However, based on our testing, a valid email address isn’t actually required to successfully opt-out — any random string of letters can be put in the email address field, and Meta will likely honor the request. When pressed, Meta said that the email address is actually just for if the user would like “a receipt” for their objection, even though the field is mandatory to complete.
So make of that what you will.
‘Unlawful processing’?
In the wake of Meta’s revised notification process, some legal experts took to social media to contend that it might not be compatible with various aspects of GDPR. Indeed, Dr. Jennifer Cobbe, an assistant professor in law and technology at Queens’ College in Cambridge, argued that this amounted to “unlawful processing.”
One legal issue she highlights is that under the U.K.’s GDPR, so-called “special category data” requires extra protection due to its sensitivity. This is important, because sensitive characteristics — such as a person’s racial or ethnic origin, political opinions, beliefs, health information, sexual orientation, and more — could easily be conveyed publicly to friends on Facebook. And Article 9 of GDPR explicitly states that the data subject (i.e. a Facebook user) must give explicit consent for special category data to be processed — which means it should be opt-in.
So while Meta is forging ahead with its data training plans in the U.K., claiming it has a “legitimate interest” to grab people’s data, it could face fresh bumps in the road if users opt to file formal complaints with the regulator.
Asked whether Meta’s revised approach to process people’s data for AI meets the bar, the ICO pointed TechCrunch to its previous statement, issued three weeks ago. In it, Stephen Almond, its executive director for regulatory risk, said it would “monitor the situation as Meta moves to inform UK users and commence processing in the coming weeks.” So if enough users raise a stink, the ICO could be forced to act.
At the time, Almond emphasized the ICO hadn’t approved Meta’s approach, adding and that it is up to Meta to “ensure and demonstrate ongoing compliance.”
