A German higher regional court has cleared Meta to use public data from Facebook and Instagram users to train its AI systems, dismissing an emergency lawsuit from a consumer protection group.
Back in April, Meta announced it would start using publicly available information from adult users—including names, profile photos, comments, and likes—to train its Llama language models. This data will also power "Meta AI," the company's chatbot now integrated into WhatsApp. Meta says private content like messages and chats won't be touched.
German users have until May 26 to object or set their profiles to private. Instructions are available here (in German).
While users can opt out later, Christine Steffen from the consumer group that filed the lawsuit warns it's nearly impossible to remove data once it's been used for AI training: "All data that has been entered into the AI is difficult to retrieve."
Court says AI training is legitimate
The German court found (in German) Meta's approach fits within European privacy law (GDPR). Even though Meta strips out user names and other identifiers, the court still considers this personal data. But Meta's business interests in developing AI outweigh users' privacy concerns in this case.
The court acknowledged that fully anonymizing the data isn't technically feasible, making it necessary to process de-identified but still partly personal information.
The judges leaned on a December 2024 opinion from the European Data Protection Board (EDPB), which says companies can use publicly available adult data—the kind you can find through search engines—under data protection rules.
Meta meets these standards, according to the court. The company swore under oath that sensitive details like account information, home addresses, or license plate numbers won't make it into the training data.
This ruling is provisional and only covers the emergency proceedings. A full trial could reach a different conclusion. There's also the question of whether Meta's practices violate the Digital Markets Act (DMA), a European law that limits combining personal data across multiple platforms. Unlike an EU Commission ruling in April, the German court didn't find a violation here.
