- Austria-based digital rights group, noyb, has sent a cease and desist letter to Meta over its AI training plans in the EU
- All public posts and user interactions are set to feed Meta AI in the EU starting from May 27, 2025, as an opt-out option
- Unlike what Meta claims, noyb argues Meta AI training isn’t compliant with GDPR and threatens to file an injunction as a potential next step
Austria-based digital rights group noyb is threatening Meta with an injunction over its AI training plans in the EU, arguing these aren’t compliant with data privacy laws.
The big tech giant is set to feed its Meta AI models with all public posts and users’ interactions starting from May 27, 2025, as an opt-out option. This means that European Facebook and Instagram account holders must fill out an objection form before this date if they don’t wish any of their data to be used. Yet, noyb argues Meta should ask for opt-in consent instead, as per GDPR rules.
The group led by privacy activist Max Schrems has already filed a cease and desist letter against Meta on Wednesday, May 14, asking the company to halt its current plans. An injunction and potential class actions could be the next steps if Meta AI training goes ahead as it stands, said Schrems – something that could lead to substantial damage claims from affected users.
The legitimate interest conundrum
According to noyb, the legal conundrum around Meta AI lies in how the social media giant plans to use the legitimate interest provision ruled by Article 6(1)(f) of GDPR, which allows companies to collect and process users’ data without freely given users’ consent.
Examples of legitimate interest include using people’s data to prevent fraudulent activities, processing client data for customer service purposes, or managing employee relationships.
“The European Court of Justice has already held that Meta cannot claim a ‘legitimate interest’ in targeting users with advertising. How should it have a ‘legitimate interest’ to suck up all data for AI training?” said Scherms, arguing that in Meta AI case legitimate interest is “neither legal nor necessary.”
Furthermore, companies are also required to conduct a multi-factor legitimate interest assessment to determine if using this provision does not negatively impact on individual’s rights and freedoms.
Noyb, however, argues that Meta AI training won’t be able to comply with other GDPR rights, such as the right to be forgotten or the right to access their data afterwards. That’s because, once in an LLM database, it’s very hard (if not impossible) to retrieve the data.
Commenting on this, Schrems said: “Meta simply says that its interest in making money is more important than the rights of its users.”
🚨 Today, noyb has sent a cease and desist letter to Meta regarding its AI training plans in Europe.👉 If Meta doesn’t comply with the request, noyb could file an injunction – or launch an EU class action in the future.All the details 👇https://t.co/VKXXdyFqo9May 14, 2025
Meta announced its intention to resume Meta AI training in the EU on April 14, 2025. The company had to pause its launch in 2024 amid growing concerns among EU data consumer protection and regulators.
Noyb was among those filing privacy complaints to stop Meta from training its AI models with Europeans’ data back in June last year.
In an official announcement, Facebook and Instagram’s parent company ensures it has engaged with EU regulators and its approach complies with European laws.
Specifically, the company refers to an opinion issued by the EDPB in December, which provides a guide to help the Irish Data Protection Authority (DPA) assess the use of legitimate interest as a legal basis for AI models.
How should Meta have a ‘legitimate interest’ to suck up all data for AI training?
Max Schrems, noyb
Yet, according to Schrems, this isn’t enough to make Meta AI training legally sound.
He said: “As far as we have heard, Meta has ‘engaged’ with the authorities, but this hasn’t led to any ‘green light’. It seems that Meta is simply moving ahead and ignoring EU Data Protection Authorities.”
So far, only a German consumer protection group, the North Rhine-Westphalia Consumer Advice Center (VZNRW), has questioned Meta AI’s legality and issued an official request to Meta to halt its AI training plans in the EU. As noyb notes, national Data Protection Authorities (DPAs) have largely remained silent, despite calling on citizens to urgently opt out of Meta AI training.
On its side, Meta has dismissed the VZNRW’s accusations and warned that an injunction against Meta’s AI training would hurt both the German and EU AI market.
What’s next?
As mentioned, Meta is set to start feeding its AI models with all EU Facebook and Instagram account holders’ posts and interactions starting from May 27.
While noyb said to be currently evaluating their option to file an injunction or a class action if Meta goes through with its plan, the group keeps arguing that asking for user consent is the simplest solution to fix GDPR issues around Meta AI training.
In the meantime, though, it’s crucial that Meta users in the EU opt out if they don’t want the company to start using their data for AI training. That’s because, as privacy firm Proton, the provider behind one of the best VPN and encrypted email apps, pointed out in a LinkedIn post: “It’s hard to predict what this data might be used for in the future – better to be safe than sorry.”
To do so, you need to log in to your account and fill out an objection form (a form for Facebook and one for Instagram). A reason to object isn’t required.
