DPC statement on Meta AI

Over the past two years, the Data Protection Commission (DPC) has been engaging intensively with many of the leading technology companies at the forefront of AI developments in particular concerning the use of adult's personal data to train Large Language Models in the EU/EEA. Whilst acknowledging that aspects of the application of GDPR to this fast changing technology remains complex, through our regulatory engagement the DPC has ensured that companies understand what is required in order to reduce high risks and harms to individuals. This has resulted in a number of companies implementing improvements and additional data protection safeguards prior to launch in the EU.

In March 2024, Meta informed the DPC of its plans to train its Large Language Model using public content shared by adults on Facebook and Instagram across the EU/EEA. Having engaged with Meta, and having reviewed initial correspondence, the DPC identified a number of issues with the proposed roll-out of Meta’s plans.

The DPC communicated its concerns to Meta, following which Meta informed the DPC in June 2024 of its plans to pause the training of its model. The DPC also engaged with its European Data Protection Board (EDPB) peer supervisory authorities by seeking a formal GDPR Opinion in September 2024. The DPC’s objective in seeking an Opinion was to achieve Europe-wide regulatory harmonisation and clarity on a number of key AI model training and deployment related questions. The Opinion, which was issued in December 2024, provided general criteria that Data Protection supervisory authorities should take into account when assessing compliance of the processing of personal data for the development and the deployment of AI models.

Following the publication of the Opinion, Meta reassessed its proposal and provided updated documentation to the DPC in respect of its plans to begin training of its generative AI model(s) on 27 May 2025. Having reviewed Meta’s proposals, and following feedback from the other EU/EEA supervisory authorities, the DPC made a number of recommendations to Meta regarding the potential impact for the data protection rights of individuals. Meta has been responsive to the DPC’s requests during this process and as a result, Meta has implemented a number of significant measures and improvements, including the following:

• Updated transparency notices to users, including specific notifications to all users in both 2024 and 2025;
• Updated and easier to use Objection Form;
• Provision of longer notice period to users and information on controls available to change all published posts from public to private to avoid being trained for the model;
• Ensuring Objection Forms work in-app, and in all jurisdictions across Europe;
• Provided access to the Objection Form for over a year;
• Updated its measures to protect data subjects, such as de-identification, filtering of data sets and output filters; and
• Updated its risks assessments and other required documentation under GDPR such as their Legitimate Interest Assessment, Data Protection Impact Assessment and a Compatibility Assessment.

As part of our ongoing monitoring, the DPC has required Meta to compile a report which, amongst other things, will set out an updated evaluation of the efficacy and appropriateness of the measures and safeguards it has introduced regarding the processing taking place. This report is expected in October 2025.

The DPC continues to actively monitor the roll-out of the Objection Forms (and information to users) to ensure that all concerned persons have an opportunity to object to the processing of their public posts (private posts are not in scope). Users will have received notifications in Facebook and Instagram advising them how they can object to this processing. Users will also have received information as to how the training of AI impacts their personal data and other measures users can take to avoid their data being used for this purpose, for instance, by changing the settings of all of their public posts to private. 

The DPC reminds all individuals using social media and internet platforms to regularly review their privacy settings and controls so that these continue to reflect their personal preferences.

The DPC will continue to assess compliance by all companies in this area and will continue to exercise its full range of regulatory functions as required. Our goal at pre-processing stage is to ensure that companies innovate responsibly, mitigate identified harms and risks to individuals and appropriately consider data subjects’ rights by balancing and protecting fundamental rights against the companies’ interests. The DPC, as the Lead Supervisory Authority for many of the large global technology companies, continues to regulate fairly, consistently and coherently, striving to ensure that all entities developing and deploying AI models across the EU/EEA are treated in the same manner.