Meta has said it's relying on a legal provision within the GDPR called “legitimate interests” (LI) -- which it suggests justifies not obtaining people's consent first. But its use of the same legal basis for processing personal data for its micro-targeted advertising business was struck down by the Court of Justice of the European Union in a July 2023 ruling. Privacy experts argue LI is similarly inappropriate for Meta to grab people's data for training AIs.

Given that Meta's U.K. business now sits outside the EU's jurisdiction, the company has -- nonetheless -- forged ahead with its data-training endeavors in the U.K., making only minor changes to the opt-out process it offers local users. It has done this is in spite of the U.K.'s domestic data protection rules still being based on the EU's GDPR. It is also not currently processing EU users' data for training AIs.

Objection, your honor

A major bone of contention for U.K. users is that Meta is not making it easy for people to object to their posts becoming AI training fodder.

It's true that Meta's revised opt out process requires slightly fewer clicks than the earlier one which triggered objections from the U.K.'s Information Commissioner's Office (ICO). There is also less corporate lingo for people to sift through, compared to before. But the process of asking to opt out is still far more onerous than it needs to be.

The overriding issue also hasn't changed: Meta is only offering users an opt-out, rather than giving them a free choice over use of their data for AI training. If it did that, users would need to affirmatively "opt in" before it could use their information and that's still not the case here. Unless the user objects, Meta will be using their information to train its AI -- assuming it does honor the objection.

So how do you object? Once the user clicks on Meta's notification (assuming they see it), they're taken to a page that informs them of Meta's plans, and also tells them they have the "right to object" to this use of their information.

"If your objection is honoured, from then on, we won't use your public information from Facebook and Instagram to develop and improve generative AI models for our AI at Meta features and experiences," the notification states.

If the user wishes to object, they must click on the hyperlinked word "object," and are then taken to a form to complete.

The form is pre-populated with the email address associated with the user's account. One notable change here versus Meta's last opt-out is that a box asking the user to explain how Meta's data processing impacts them has been marked as "optional" -- whereas when Meta tried to roll this out a few months back, the user was required to write something.

Despite a few tweaks, the revised process Meta has designed still does not conform to a strict opt-out, either -- while Meta has publicly claimed that it will honor every objection, the wording throughout the process states that it's at Meta's discretion.

Asked about this, Meta spokesperson, policy communications manager Matt Pollard, said in an email that the language around the whole "if the objection is honored" bit, is due to its requirement that users submit a valid email address connected to their account.

However, the user needs to be logged in to their Facebook account in order to submit the form, and the email address field is pre-populated with the user's linked email address, so it's not clear how an invalid email address would be submitted unless the user was to manually edit their email address that's already in there.

"There’s no ambiguity here at all, it’s very straightforward -- we will honour all objection forms received," Pollard added.

However, based on our testing, a valid email address isn't actually required to successfully opt-out -- any random string of letters can be put in the email address field, and Meta will likely honor the request. When pressed, Meta said that the email address is actually just for if the user would like "a receipt" for their objection, even though the field is mandatory to complete.

So make of that what you will.

'Unlawful processing'?

In the wake of Meta's revised notification process, some legal experts took to social media to contend that it might not be compatible with various aspects of GDPR. Indeed, Dr. Jennifer Cobbe, an assistant professor in law and technology at Queens' College in Cambridge, argued that this amounted to "unlawful processing."

https://twitter.com/jennifercobbe/status/1841409118902309163

One legal issue she highlights is that under the U.K.'s GDPR, so-called "special category data" requires extra protection due to its sensitivity. This is important, because sensitive characteristics -- such as a person's racial or ethnic origin, political opinions, beliefs, health information, sexual orientation, and more -- could easily be conveyed publicly to friends on Facebook. And Article 9 of GDPR explicitly states that the data subject (i.e. a Facebook user) must give explicit consent for special category data to be processed -- which means it should be opt-in.

So while Meta is forging ahead with its data training plans in the U.K., claiming it has a "legitimate interest" to grab people's data, it could face fresh bumps in the road if users opt to file formal complaints with the regulator.

Asked whether Meta's revised approach to process people's data for AI meets the bar, the ICO pointed TechCrunch to its previous statement, issued three weeks ago. In it, Stephen Almond, its executive director for regulatory risk, said it would "monitor the situation as Meta moves to inform UK users and commence processing in the coming weeks." So if enough users raise a stink, the ICO could be forced to act.

At the time, Almond emphasized the ICO hadn't approved Meta's approach, adding and that it is up to Meta to "ensure and demonstrate ongoing compliance."

This article originally appeared on TechCrunch at https://techcrunch.com/2024/10/03/hey-uk-heres-how-to-opt-out-of-meta-using-your-facebook-and-instagram-data-to-train-its-ai/