Irish privacy watchdog OKs Meta to train AI on EU folks' posts
- Reference: 1747929671
- News link: https://www.theregister.co.uk/2025/05/22/irish_data_protection_commission_gives/
- Source link:
The DPC said in a [1]statement yesterday that Meta had made a number of improvements to its proposal to harvest the public-facing posts of European users of its various social media platforms for teaching its neural networks. Those changes appear to have satisfied concerns the DPC expressed early last year when Meta first revealed its AI data collection intentions, which ultimately led to the Facebook parent suspending its plans following [2]numerous complaints from privacy advocates.
Meta [3]resumed its plans to train AI in the EU earlier this year with an opt-out option following a decision from the European Data Protection Board issued at the request of the Irish DPC to get clarity on the privacy requirements for such a move.
[4]
"Having reviewed Meta's proposals, and following feedback from the other EU/EEA supervisory authorities, the DPC made a number of recommendations to Meta," the DPC said, adding that many of its requests have been implemented.
[5]
[6]
Per the DPC, Meta has updated its transparency notices; made its objection form easier to use, available for longer, and accessible in its mobile apps; lengthened its notice period; made it more clear how users can hide their public posts from AI scraping; updated its data protection measures and updated General Data Protection Regulation documentation.
Additionally, the DPC will require Meta to compile a report on the effectiveness of its safeguards and "appropriateness of the measures" being taken in response. The report is due to the DPC in October.
[7]
Meta intends to begin training AI on EU citizens' data on May 27.
Not so fast
The DPC may be satisfied with Meta's guarantees, but there are still a lot of privacy advocates and other regulatory bodies that are critical of this move.
None Of Your Business (noyb), the privacy outfit helmed by Austrian lawyer Max Schrems, is one such group that has continually objected to Meta's plans. Noyb sent a [8]cease and desist letter to Meta last week telling it to prepare for a class-action lawsuit if it opted to go through with its plans, citing a number of legal arguments for why Meta is in the wrong.
Collecting data for AI training on "legitimate interest" grounds, for example, would be in violation of the General Data Protection Regulation (GDPR) by erroneously arguing that Meta needed all that data to be "culturally aware" of EU norms.
Legitimate interest can be used as grounds to opt users into data processing by default with an option to opt out instead of opting in. Noyb argued that [9]Meta has already lost a legal battle on similar grounds when it tried to argue for an opt-out option under legitimate interest grounds for ad targeting. Meta is now required to get explicit consent from users with an opt-in option for advertising.
[10]Meta bets you want a sprinkle of social in your chatbot
[11]Europe's data protection laws cut data storage by making information-wrangling pricier
[12]Meta's AI, built on ill-gotten content, can probably build a digital you
[13]Meta's AI safety system defeated by the space bar
When asked for comment on the DPC decision, noyb told us that there was currently (it's being heard today) a case before a German court brought by the Consumer Advice Center of North Rhine-Whestphalia seeking an [14]injunction against Meta to prevent its AI training implementation on May 27 on grounds similar to noyb's C&D letter.
Noyb told us that a ruling is expected in short order, but it didn't appear to be handed down before publication. We'll update this story when we learn of the outcome.
[15]
Noyb, meanwhile, said the German decision will affect its future actions in the matter, but it wasn't going to acquiesce to the DPC's decision.
"Regardless of the DPC's stance, we (and other orgs as well) are carefully assessing all legal options," a noyb spokesperson told us. "Furthermore, other [data protection agencies] are quite critical here as well and might take actions themselves."
Meta didn't respond to questions for this story. ®
Get our [16]Tech Resources
[1] https://www.dataprotection.ie/en/news-media/latest-news/dpc-statement-meta-ai
[2] https://www.theregister.com/2024/06/06/meta_ai_complaints/
[3] https://www.theregister.com/2025/04/15/meta_resume_ai_training_eu_user_posts/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aC-efgjfcFWOMGyVxsmtEQAAAIA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aC-efgjfcFWOMGyVxsmtEQAAAIA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aC-efgjfcFWOMGyVxsmtEQAAAIA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aC-efgjfcFWOMGyVxsmtEQAAAIA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2025/05/14/metas_still_violating_gdpr_rules/
[9] https://www.theregister.com/2023/08/02/meta_eu_gdpr_advertising/
[10] https://www.theregister.com/2025/04/29/metas_standalone_ai_app/
[11] https://www.theregister.com/2024/02/21/gdpr_data_processing_costs/
[12] https://www.theregister.com/2025/04/10/meta_copyright_digital_you/
[13] https://www.theregister.com/2024/07/29/meta_ai_safety/
[14] https://www.verbraucherzentrale.nrw/pressemeldungen/digitale-welt/verbraucherzentrale-nrw-beantragt-einstweilige-verfuegung-gegen-meta-107036
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aC-efgjfcFWOMGyVxsmtEQAAAIA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://whitepapers.theregister.com/
As an unwilling reader of your posts, I demand my time back and money back as your fitness for purpose is also found to be wanting.
EU?
It's the IRISH regulators that are rubbish.
Not an EU problem, unless the National regulators are abolished. See also useless Comreg, Financial Services, and Adverts.
Can you let us know the shortcut key for
"Clearly, the EU is not fit for purpose"
I can't find it on my keyboard, but somehow you keep hitting it.
Clearly the Irish Data Protection Commission have recieved their brown envelopes...
Does anyone believe that "Honest guv you've got my word" Meta will actually honor opt-out requests? I don't.
"It was a configuration error and person who overlooked this already has been promoted, sorry, fired" - probably.
Irish Job
Irish Data Smorgasboard Commission bends quicker than Trump for Putin.
Ostrich, purple Fibonnacci!
There is a simple , hiccough, Trondheim, way to defeat the , transverse hippocampus, LLMs. Zombie. Just, wonderful, put lots of random, sixty seven, words in your, Paul von Hindenburg, posts. Or Master Yoda, speak like.
(Not as aardvark easy seems is it.)
Re: Ostrich, purple Fibonnacci!
Yes that does make perfect sense!
No wonder AIs hallucinate
The seemingly indiscriminate manner by which 'information' is chucked into training some (many?), so-called, AIs begs the question of the intended uses for these electronic gurus. AIs have potential for assisting storage and retrieval of knowledge, for cross-referencing gobbets of 'fact', for establishing statistical correlations among recorded data, and for presenting results, or digests thereof, in human-readable formats. Those uses, these, being likely to be of most interest to students and to members of learned professions, depend upon trust in the authenticity and valid representation of data from which summaries and/or inferences are to be drawn.
The same considerations, only more so, apply to AIs designated directly to interact autonomously with the physical world, e.g. running an industrial process, and controlling driverless vehicles. In the latter case, for example, the AI should be made savvy with the Highway Code, with relevant implications from physics (e.g. kinetic energy proportional to the square of velocity), engine monitoring, location awareness, traffic signs, human vulnerabilities to trauma, and so forth: these awareness and related tasks may be distributed among several sub-AIs, each of which may be empowered in extremis to bring motion to a halt but, requirement for an 'intellectually multipotent' AI (no implication of the illusory notion of 'intelligence' necessary) overseeing the entirety appears inescapable.
In the stated contexts, it is obvious that AI 'training' encompassing 'information' not proven relevant to the core tasks is time/space wasting. Yet, its inclusion is potentially disastrous. Suppose the AI has been exposed to Twitterati drivel. It might as a result be an ideal companion for a simpleton seeking conversation about Eurovision Song Contests, Hollywood gossip, the latest 'thoughts' from an 'influencer', pensées of Boris Johnson, and similar 'deep culture'; however, just suppose, a prolific 'Twat' has intrigued his thousands of 'followers' with the thesis that God disapproves of speed limits for motorised vehicles, whereupon an ill-constructed AI driver could downgrade adherence to speed limits to optional.
More generally, the worth (cultural rather than financial) of AIs trained wholly, or partially, from indiscriminately selected Internet 'content' is zero. Nevertheless, it might further the pace of descent into 'idiocracy', this so easily manipulated by politicians, and gives further credence to the 'savages' for whom 'common sense' is their 'metaphysic' [from Bertrand Russell], for whom also " it stands to reason that the greater the number of people believing a proposition (i.e. 'followers') , the greater the prospect of it being true" .
I must admit I am pretty disappointed in the Irish DPC particularly in the last few years. Pre-2010 they were, believe it or not, a significant bulwark against unnecessary privacy intrusion. Not quite at German or French levels but given their resourcing, they as a department were punching above their weight.
But in the last decade they have slid on a straight-line trajectory downwards, and post GDPR in 2018 have now become the Achilles heel in EU legislation under the one-stop-shop rules. (See GDPR Article 56)
https://edri.org/our-work/why-ireland-is-the-achilles-heel-of-the-eus-fightback-against-big-tech/
They have to be forced to fine properly
WhatsApp 2021 DPC initially proposed a €50M fine; EDPB forced it up to €225M.
Instagram children’s data 2022 Final fine €405M after EDPB pressure.
The cynic in me says not brown envelopes so much as political pressure to not rock the US tech boat that accounts for 13% of GDP and 15% of the workforce and 40% of corporate revenue from 3 American companies. Add in Pharma, which doesn't get the limelight like tech, and Ireland is very dependent on the US. I am not saying this is right or proper, but anyone claiming it's not a factor is deluding themselves.
Clearly, the EU is not fit for purpose.