Austrian privacy watchdog NOYB (None of Your Business) announced Wednesday that it intends to pursue legal measures against Meta Platforms if the company proceeds with its plan to use data from European Facebook and Instagram users to train artificial intelligence models.
The advocacy group, led by well-known privacy campaigner Max Schrems, issued a cease-and-desist notice to Meta, which plans to begin incorporating user data into its AI training programs starting May 27. Meta claims the move is covered by "legitimate interest" under EU privacy regulations, asserting that user data is necessary for the development of its AI tools, some of which may be accessible to third parties.
According to Meta, users will have the ability to opt out through a form, and data from minors’ accounts, as well as private messages, will be excluded from the training datasets.
Schrems criticized Meta’s justification, referencing previous European court rulings that limited the company's ability to rely on legitimate interest for advertising. "If Meta can’t use this reasoning to serve ads, how can it use it to harvest all personal data for AI purposes?” he asked.
NOYB is weighing the possibility of filing for an injunction under the EU's Collective Redress framework, which enables collective consumer action across member states. Schrems noted that damages could reach billions of euros if even a fraction of Meta’s 400 million European users each sought compensation.
The group set a May 21 deadline for Meta to respond before initiating further legal steps.
In response, Meta dismissed NOYB’s claims, saying its data-use policy aligns with guidance from the European Data Protection Board and that it has consulted with Ireland’s data protection authority. A company spokesperson stated, “NOYB’s allegations are factually and legally incorrect. We've informed users clearly and given them a straightforward way to opt out.”
NOYB argues that Meta should instead require users to actively opt in and ensure that any AI training only utilizes anonymized data, in compliance with EU privacy standards.