Meta has recently rekindled its controversial intentions to utilize the public posts of U.K. users on Facebook and Instagram as training data for its AI systems. The social media titan has begun notifying users that it will once again access their information. Unfortunately, the opt-out process Meta has created for users who wish to withhold their data is as cumbersome as before.
Here’s a detailed breakdown of the updates and how users can object…
‘New AI Features Just for You…’
Last week, Meta started issuing notifications regarding this impending data gathering, similar to its prior attempt. These messages are integrated alongside other alerts, like friend requests and group updates, making them easy to overlook. In contrast, when Facebook encourages users to vote, the notifications are prominently displayed at the top of their feed.
The wording of these notifications implies that users have little choice. Meta promotes “new AI features for you” while stating that users can “Learn how we use your information,” without clearly indicating that they can opt-out of data processing.
Even if a user notices the notification, objecting to the data use requires several clicks and scrolling through multiple pages. Furthermore, Meta claims it has discretion over whether to honor these objections, potentially discouraging users from taking action.
‘Legitimate Interest’
Meta has long used user-generated content for AI training across various regions. However, Europe’s stringent data protection laws, specifically the GDPR, complicate its efforts. Meta argues that accessing local user-generated content is essential for improving its language models, helping it reflect the diverse European populace. Still, the GDPR mandates a valid legal basis for processing personal information for AI training.
Back in June, Meta halted its plans to leverage European user data for AI training following pushback from regulators in the EU and U.K. These authorities objected to the opt-out approach, insisting that user consent should be obtained first.
Meta relies on a GDPR provision known as “legitimate interests,” claiming it justifies skipping prior consent. However, a July 2023 ruling from the Court of Justice of the European Union rejected Meta’s use of this claim for its micro-targeted advertising. Privacy advocates argue that relying on this basis for AI training is equally inappropriate.
Given that Meta’s U.K. operations are now outside EU jurisdiction, the company is proceeding with its data training initiatives while only making minor adjustments to its opt-out process. This occurs despite the U.K.'s domestic data regulations still aligning with the EU's GDPR. Currently, it is not processing data from EU users for AI training.
How to Object
A primary concern among users in the U.K. is the lack of ease in objecting to their posts serving as training material for AI. Although Meta has slightly streamlined its opt-out process, it remains more complicated than necessary.
The core issue persists: users are offered merely an opt-out option instead of a true choice over how their data is used for AI training. Currently, Meta will use users' data unless they actively object, assuming the company chooses to respect the request.
To lodge an objection, users must click on Meta’s notification (if they see it), which leads to a page detailing Meta’s plans, including the “right to object” to the data use. The notification states, “If your objection is honored, we won’t use your public information from Facebook and Instagram to develop and improve generative AI models.”
Upon clicking the hyperlinked word “object,” users will be directed to a form where the email address linked to their account is pre-filled. One notable change from Meta's previous opt-out process is that users are no longer required to elaborate on how Meta's data processing affects them.
Despite these minor adjustments, the new process still does not conform to a strict opt-out framework. While Meta asserts it will honor all objections, the language used throughout implies that the decision ultimately rests with the company.
Meta spokesperson Matt Pollard clarified that the phrasing about honoring objections relates to its requirement for a valid email address. However, since users need to be logged in to submit the form, and the email field is automatically filled, it raises the question of how an invalid email could be submitted. He assured that the process is “very straightforward” and that all objections will be honored.
Nonetheless, tests indicate that a valid email isn't necessary for opting out, as any random string can be entered in that field. Meta claims the email is simply for providing a “receipt” for the objection, even though it remains a required field.
Legal Implications
Following Meta’s updated notification process, some legal experts voiced concerns about its alignment with various aspects of the GDPR. Dr. Jennifer Cobbe, an assistant professor in law and technology, stated that this could be deemed “unlawful processing.”
She pointed out that under the U.K.’s GDPR, “special category data,” which includes sensitive personal information, requires heightened protection. This is crucial since such sensitive details—like race, political beliefs, and health information—may be shared publicly on Facebook. Article 9 of the GDPR mandates explicit consent from users for processing special category data, indicating an opt-in requirement.
While Meta maintains its data training plans in the U.K. under the guise of a “legitimate interest,” it may encounter obstacles if users choose to file formal complaints with regulators.
The Information Commissioner’s Office (ICO) has reiterated that it will monitor the situation as Meta moves forward with these changes. Stephen Almond, the executive director for regulatory risk, emphasized that it’s up to Meta to ensure compliance, and the ICO has not approved Meta’s approach.
Conclusion
With the complexities surrounding data use for AI training, users should stay informed about their rights and the processes available for objection. As the landscape evolves, ongoing vigilance from both users and regulators will be critical in safeguarding personal data.
Ranking
