Instagram — Policy Change
Executive Summary
Meta announced a policy update allowing EU users' public posts, comments, and photos to train generative AI models. Following complaints from noyb to 11 EU data protection authorities, Meta paused the policy before its effective date. It was later rescheduled for May 2025 with updated compliance documentation.
What Happened
In June 2024, Meta announced a privacy policy change to allow the use of public posts, comments, photos, and certain non-public user data from Facebook and Instagram to train its AI systems, relying on a legitimate interest legal basis under GDPR rather than requiring user consent. Privacy organization noyb filed complaints with data protection authorities in 11 EU countries challenging this approach. Following pressure from the Irish Data Protection Commission and the UK's Information Commissioner's Office, Meta paused the policy change before its scheduled June 26, 2024 effective date, with plans to reschedule implementation for May 2025.
Who Is Affected
The policy affects approximately 4 billion Meta users globally, with specific focus on users in the European Union and European Economic Area countries including Austria, Belgium, France, Germany, Greece, Italy, Ireland, the Netherlands, Norway, Poland, and Spain, as well as the United Kingdom. Users with both active and dormant Facebook and Instagram accounts containing data collected since 2007 are impacted, with the exception of individual-to-individual private chats.
Why It Matters
This case represents a significant test of GDPR enforcement regarding AI training on user-generated content at massive scale, particularly the contested use of legitimate interest rather than explicit consent as a legal basis for data processing. The approach mirrors Meta's previous unsuccessful attempt to justify targeted advertising using legitimate interest, which was rejected by the Court of Justice of the European Union. The broad scope of data collection and undefined purposes for AI technology raise fundamental questions about the limits of how companies can repurpose years of personal information for emerging technologies.
What You Should Do
EU and UK users should monitor for further notifications from Meta regarding the rescheduled May 2025 implementation date and any updated privacy policy documentation. Users can review their Facebook and Instagram privacy settings to understand what content is currently public versus private. If users wish to object to their data being used for AI training when the policy takes effect, they should watch for Meta's opt-out mechanism, though the effectiveness of such options remains subject to ongoing regulatory review.
AI-Assisted
Event summaries are generated by Claude AI from verified sources and reviewed by humans before publication.
Sources