The social media giant, owner of Facebook, Instagram and WhatsApp, is sending emails to its users in Spain to warn of a change in its policies. “We are preparing for enable our AI experiences in Meta in your region«, they warn, and for this reason, their privacy rules are modified to include the use of data from Instagram users, such as photos, captions or posts, to train their AI model.
This new policy comes into effect on June 26, 2024, and although Meta offers a link from which to object to the use of this data, the procedure is cumbersome and opaque: «It cannot be exercised in a simple way, since it requires seven steps; Furthermore, in no case is it a complete opposition, nor does it exclude third parties,” they criticize from the OCU. Furthermore, it is striking that Meta can start using the data by default, and request an action from the user to object, instead of the other way around, asking for permission before starting to extract information.
For all these reasons, the consumer defense organization has decided to report Meta to the authority responsible for data in Spain: the Spanish Data Protection Agency (AEPD). The OCU considers that “said update is being carried out in a way little transparent«.
From the entity they regret that “the right of opposition is not complete, since Meta’s AI does not distinguish in the photos between the profiles of users who authorized the use of their data from the rest. In fact, Meta does not inform what use it makes of the data of third parties who have not previously given their consent, among which there may be minors that appear in family photographs or videos that have been posted on social networks. And although users can refuse to use their images to train the AI, they could also enter the Meta sweep due to other photos in which they appear, uploaded to Instagram by other users who have not refused.
Given that the operation begins on June 26, the OCU requests the AEPD to “start urgency an action that prevents the use of the personal data of those affected (users and non-users)”, and that offers a verdict, if possible, before that date.
In order to exercise the right to object to the use of data by third parties, it is possible to use another form from this link, which Meta, however, does not include in the emails sent this Friday.
The decision to report by the OCU fits with its position on AI services in general, perceiving a lack of protection for users: “It is impossible for an average consumer to be aware of the current and future scope of their consent for the use of their personal data”, they point out from the organization, in reference not only to Meta but to other companies such as OpenAI.
A complex and demanding process
The consternation arises, in part, from the fact that rejecting this data processing does not consist of clicking on a menu of options, but rather the process that Meta has designed to oppose is long and demanding on the user. This is because it requests the introduction of the country of residence, email address, and filling out a mandatory box explaining “how the processing of this data affects you.” In addition, there is another extra box, although this is presented as optional: “Provide additional information that may be useful to us in reviewing your objection.”
Meta does not make it clear what should be written in these two boxes, and also forces the user to keep an eye on the email, since the notification has been sent to users in this way.
At ADSLZone we have tried to fill out the opposition form, and we have received a confirmation in a very short time, which has the format shown in the previous image. In this case, it was enough to write something like “I do not authorize Meta to use my data” in the required box.
