The National Data Protection Authority (ANPD) announced Friday that it had lifted the suspension imposed on Meta in July. The suspension prevented the company from using Brazilians' personal data to train its artificial intelligence models. The ban, the ANPD's first protective measure against a major tech company, was justified by the "imminent and irreparable" risk to users' fundamental rights.
Meta, the company that owns Instagram, Facebook, and WhatsApp, has begun using open user posts on these platforms to train its generative AIs, according to a change in its privacy policy on May 22. However, the company did not publicly report this change in Brazil, which has a large user base, with 113.5 million people active on Instagram and 102 million on Facebook.
New Transparency Measures
The new ANPD decision allows Meta to resume using personal data, provided it complies with a compliance plan with clear transparency rules. Among these measures, Meta must inform users of their right not to allow their data to be used for AI training. The company has five business days to implement this agreement.
According to the ANPD, users will receive email and in-app notifications with clear information about how their data is processed. In addition, Meta will have to maintain permanent notices on its privacy page, and any user can object to using their data with a single click. Even those with no social media account but whose data may have been shared can prevent its use by providing some basic information.
ANPD's general auditing coordinator, Fabrício Lopes, explained that Meta wanted to request additional information from users to oppose using their data. Still, ANPD considered this excessive, so this option will be optional. In addition, Meta has committed not to use data from children under 18 until ANPD makes a final decision.
Reactions and Concerns
Miriam Wimmer, director of the ANPD, stressed that the decision allows individuals to make informed decisions about using their data and that the initial risks have been mitigated. However, she clarified that the auditing process will continue and that there are still pending discussions on legal aspects related to "legitimate interest," which is the argument used by Meta to justify the use of data without explicit consent.
Meta, in a statement, noted that it is working to develop AI resources securely and respect users' privacy. In addition, the company confirmed that it will abide by the transparency measures required by the ANPD.
On the other hand, the Consumer Defense Institute (Idec) expressed concern about the agreement, considering that the compliance plan is insufficient and that the data processing is still incompatible with the General Data Protection Law (LGPD). As reported by Folha de São Paulo, Idec considers that the legal basis used by Meta has not been adequately evaluated by ANPD, leaving the possibility of future legal disputes open.
