Data from
Facebook and Insta
for AI training.
Data from
Facebook and Insta
for AI training.
from
Meta wants to use public user data from Facebook and Instagram to train its own AI systems. Users who do not want this should object. The North Rhine-Westphalia consumer advice center considered the procedure to be unlawful.
Meta wants to train AI with user data
In April 2025, Meta Platforms Ireland Limited announced that it would use personal data from publicly viewable user profiles on Facebook and Instagram to train its own AI systems from May 27, 2025. The announcement concerned both information from users and – where publicly posted – from third parties. Meta made it clear that only publicly visible data would be used, such as data that can also be found by search engines. Names, email addresses or postal addresses, on the other hand, will not be processed. Users also have the option of objecting to data processing or setting their content to “not public”.
Consumer advice center issues cease and desist letter to Meta Ab
The consumer advocates sent Meta a cease and desist letter because of the procedure. In the cease and desist letter dated 30.04.2025 , they argued that the specific procedure did not meet the legal requirements. The blanket reference to the legitimate interest was not sufficient in this case. Users should not accept that the personal information they have left behind on the platforms over the years is used for AI training. There is also the possibility that particularly sensitive information, which is specially protected under the General Data Protection Regulation (GDPR), will be used for AI training purposes. An opt-out, as offered by Meta, is not sufficient. Rather, the active consent of the data subjects is required.
Emergency appeal by NRW consumer advice center fails
After Meta failed to comply with the cease and desist letter, the North Rhine-Westphalia consumer advice center wanted to stop the data processing with an urgent application. However, the Higher Regional Court of Cologne rejected the application. In its decision , the court emphasized that Meta’s planned processing of publicly provided data does not currently violate data protection law or the Digital Markets Act (DMA).
In summary proceedings, the Cologne higher regional court judges had no objections to Meta, the operator of Facebook and Instagram, using public user data to train artificial intelligence (AI) without the express consent of the users concerned. What are the consequences of this decision, how should it be legally classified and what impact does it have on consumers?
Court justifies with legitimate interest
In a preliminary, summary examination, the court came to the conclusion that Meta can rely on a legitimate interest under data protection law. As the controller, Meta has a legitimate interest in the further development of AI systems, which is why data processing is permissible even without consent. In the court’s opinion, this interest outweighed the protection interests of the affected users, especially as Meta had taken measures to mitigate the interference. Among other things, only publicly accessible data is affected and users can object to the use.
The court also found no violation with regard to the DMA. In particular, there was no impermissible “merging” of data, as Meta did not assign the data to a specific user profile across different services. There was also a lack of relevant case law in this regard, which made the assessment even more difficult.
Even though the decision was made in summary proceedings and is therefore only a preliminary assessment, it has far-reaching significance. Firstly, it confirms that the use of publicly available data by companies for the training of AI systems constitutes a legitimate interest. Under certain conditions, processing is also possible without the express consent of the data subjects.
Criticism and open questions
The decision of the Cologne Higher Regional Court has been heavily criticized by some. This is seen as an infringement of informational self-determination, particularly in the case of data from third parties or minors. Meta does not provide any information regarding the handling of particularly sensitive information, such as that found in images. As far as is known so far, only unique identifiers such as the name, e-mail address or postal address of individual users are not to be used. There is currently still a need for clarification regarding the further processing of personal data, in particular images.
It will therefore be interesting to see how any main proceedings will proceed, in which a more detailed legal and factual examination will then take place. The decision is also likely to trigger new discussions at European level, particularly regarding the interpretation of the DMA and the role of publicly available data in the context of AI training.
Conclusion
With its decision, the Higher Regional Court of Cologne clears the way for public profile data to be used for AI training. Those responsible can therefore invoke a legitimate interest, which significantly strengthens the position of those responsible and AI providers.
For users, this means that their publicly accessible content on Facebook and Instagram may be part of Meta’s AI initiatives in future, unless they actively object by May 27, 2025. In future, users will therefore have to take action if they do not want their content to be made available as training data for AI.
We are happy to
advise you about
AI!
