UPDATE — NOVEMBER 2025: As of late 2025, Meta remains prohibited from using personal data from EU and EEA users to train its artificial intelligence systems while investigations and legal actions continue. Following noyb’s 2024 cease-and-desist letter, the Irish Data Protection Commission (DPC) opened a formal inquiry into Meta’s reliance on “legitimate interest” for AI training—a review still ongoing. In June 2024, the European Data Protection Board (EDPB) issued an urgent, binding decision directing Meta to pause all AI data training in the EU, prompting the company to suspend its rollout and begin revising its approach.
In August 2024, noyb escalated its challenge by filing official GDPR complaints in Ireland and Austria, with a potential EU-wide class action under the Collective Redress Directive still being prepared. Meanwhile, Germany’s VZ NRW consumer group secured a temporary injunction blocking Meta’s AI training locally. Meta has since stated that it is developing a consent-based framework for any future AI training in Europe but continues to rely on non-EU user data to train its models.
Regulators across Europe are now examining AI data-training practices more broadly, using the EU AI Act’s transparency rules alongside GDPR enforcement to prevent what watchdogs describe as “AI model laundering” of personal information. The DPC’s final ruling—expected in early 2026—will likely determine whether Meta must erase existing AI models trained on any EU data or adopt explicit consent mechanisms before resuming operations.
ORIGINAL NEWS STORY:
noyb Sends Meta Cease-and-Desist Over AI Training With User Data, Class Action Looms
European privacy group noyb has issued a cease-and-desist letter to Meta, warning the company to halt plans to use personal data from Facebook and Instagram users in the EU to train its artificial intelligence systems. Meta announced it would begin the data use on May 27, citing “legitimate interest” rather than seeking explicit user consent—drawing sharp rebuke from privacy advocates.
The Vienna-based organization, founded by privacy lawyer Max Schrems, argues that Meta is bypassing the EU’s General Data Protection Regulation (GDPR) by treating user data as a default input for AI, rather than asking for opt-in consent. The complaint could be a precursor to sweeping legal action: under the EU’s new Collective Redress Directive, noyb and other qualified entities may file injunctions across member states and even pursue EU-wide class actions, potentially seeking billions in damages.
“Meta starts a huge fight just to have an opt-out system instead of an opt-in system,” said Schrems. “They rely on an alleged ‘legitimate interest’ to just take the data and run with it. This is neither legal nor necessary.”
The group warns that Meta’s approach not only undermines user rights but could expose the company to massive legal risks. Under GDPR, non-material damages per user can reach hundreds or thousands of euros. With approximately 400 million Meta users in Europe, damages could stretch into the hundreds of billions.
Meta’s policy gives users only the ability to opt out—and only before training begins—limiting access to rights such as data deletion or correction. Once incorporated into AI models like Meta’s open-source Llama, this data becomes practically irretrievable.
Though Meta claims to have consulted with EU regulators, noyb says it has seen no formal approval from data protection authorities. Meanwhile, consumer groups across Europe, including Germany’s VZ NRW, are also exploring litigation.
noyb is evaluating legal action in multiple jurisdictions and has not ruled out filing a full EU class action. “Even just managing this litigation will be a huge task for Meta,” Schrems said. “We’re surprised they would take this risk just to avoid asking users for consent.”
Need Help?
If you have questions or concerns about these reports, or any global AI guidelines, regulations and laws, don’t hesitate to reach out to BABL AI. Their Audit Experts can offer valuable insight, and ensure you’re informed and compliant.
