Meta Platforms Inc., the parent company of Facebook and Instagram, is facing mounting legal pressure from European regulators over its plan to use personal user data to train artificial intelligence models. Privacy watchdogs across the European Union are weighing the possibility of filing an injunction that could halt the practice, citing violations of the region’s strict data protection laws.
The controversy erupted after Meta announced updates to its privacy policy, stating it would begin using publicly shared user data from its platforms to improve AI capabilities, including its generative models. The company argued the move is necessary to keep pace with competitors in the fast-evolving AI space. However, regulators contend that the changes may bypass crucial consent requirements under the General Data Protection Regulation (GDPR).
Regulatory Response
The Irish Data Protection Commission (DPC), Meta’s lead privacy regulator in the EU due to the company’s European headquarters being based in Dublin, has reportedly received multiple complaints from advocacy groups and national data protection agencies. At least ten EU countries, including Germany, France, and Norway, have raised formal concerns about the potential misuse of personal data.
“No company is exempt from the obligation to obtain clear and informed consent for the processing of personal data — especially not at this scale,” said a spokesperson from the European Data Protection Board (EDPB), the EU’s top privacy oversight body. “We are examining whether emergency measures, including an injunction, are warranted to prevent irreversible harm.”
The EDPB confirmed it is actively coordinating a swift response under Article 66 of the GDPR, which allows for urgent actions in the face of potential risks to users’ fundamental rights.
Meta’s Defense
In a public statement, Meta defended its policy update, emphasizing that the data used would be “publicly shared content” and would exclude private messages or sensitive information. The company claims it has “a legitimate interest” in using such data to develop and improve its AI systems, an argument that falls under one of the lawful bases for processing personal data under the GDPR.
“We are committed to transparency and privacy, and we’ve designed our approach to align with European data protection laws,” said a Meta spokesperson. “Users have control over their information, and we provide clear options to opt out.”
However, critics argue that Meta’s opt-out mechanism is overly complex and lacks visibility. Advocacy groups such as NOYB (None of Your Business), founded by privacy activist Max Schrems, have accused the company of “constructive deception,” claiming users are not meaningfully informed of how their data might be used.
Broader Implications for AI Development
The outcome of this regulatory scrutiny could have far-reaching consequences for the development of AI in Europe and beyond. If an injunction is issued, Meta could be forced to halt or significantly modify its AI training practices within the EU, potentially delaying the rollout of its latest models.
Legal experts say the case could set a precedent for how global tech companies approach data use in the age of AI.
“This isn’t just about Meta — it’s about how AI is trained and what role personal data plays in that process,” said Dr. Elise Voss, a digital rights researcher at the University of Amsterdam. “It’s a litmus test for balancing innovation and individual rights.”
Next Steps
The EDPB is expected to issue a formal opinion in the coming days. If a consensus emerges that Meta’s policy violates the GDPR, a legally binding order — including a possible injunction — could follow swiftly.
As tensions between Big Tech and European regulators escalate, this case underscores the growing challenge of aligning AI development with privacy frameworks designed for a pre-AI era.
Meta, which is already under heavy scrutiny for its data handling practices, may now face another major legal battle — one that could reshape the AI landscape for years to come.