Austrian privacy group NOYB challenges Meta's AI data practices, citing GDPR violations and potential billion-euro damages.
Meta is staring down the barrel of a legal challenge in Europe—again. This time, the issue is how it plans to train its artificial intelligence.
NOYB has issued a cease and desist letter, arguing that Meta's reliance on 'legitimate interest' under EU privacy laws is insufficient and potentially violates the General Data Protection Regulation (GDPR). NOYB accuses Meta of planning to use personal user data from EU citizens to train its AI systems without proper consent.
The group claims Meta’s recently updated privacy policy, which takes effect May 26, quietly paves the way for using personal posts, photos, and interactions from Facebook and Instagram users across Europe to fuel its generative AI ambitions.
Max Schrems, founder of NOYB, criticized Meta's justification, stating, "The European Court of Justice has already held that Meta cannot claim a 'legitimate interest' in targeting users with advertising. How should it have a 'legitimate interest' to suck up all data for AI training?"
Meta’s defense? Users can opt out. But critics say the process is far from user-friendly—and that’s the point. According to NOYB, this should be an opt-in situation from the start, especially given the sensitive nature of the data in question.
In its official communication, Meta clarified that it will not use private messages or information from minors. However, NOYB isn’t convinced. The group believes Meta’s interpretation of EU law is deeply flawed and is now considering broader legal action—possibly even a class action lawsuit under the EU’s new collective redress rules.
If the case proceeds, the financial stakes could be massive. Schrems estimates that the total potential exposure could run into the billions.
The advocacy group has given Meta until May 21 to respond to its cease-and-desist letter. If Meta doesn’t back down, expect this to escalate quickly.
The Bigger Picture: AI vs. GDPR
At the heart of the dispute is the question of how far companies can stretch the boundaries of "legitimate interest" under the General Data Protection Regulation (GDPR)—a law that continues to be a thorn in the side of Silicon Valley.
While Meta maintains it is acting within the law, NOYB argues otherwise. And if the group follows through with collective action, it could cost Meta billions in penalties and restitution to users. This clash could become a landmark case—not just for Meta, but for every tech firm eyeing European data for machine learning.
