Meta’s AI Training Program Collects European Employee Data
Meta’s Model Capability Initiative (MCI), a program designed to collect data from employee workstations in the US for AI training, is reportedly capturing more European data than the company has publicly admitted. Internal documents reveal that MCI records emails and chats exchanged between US-based employees and their European colleagues. This raises concerns about compliance with the European Union’s General Data Protection Regulation (GDPR), particularly regarding the scope and purpose of data collection.
The main issue lies in the fact that Meta has consistently stated that MCI only operates on US work devices and does not monitor European employees. However, the internal evidence shows that any communication US employees have with European coworkers or customers is included in the data collected for AI training. Privacy experts argue that this practice conflicts with GDPR’s purpose limitation principle, which restricts the use of personal data to the purpose for which it was originally collected—in this case, workplace communication, not AI training.
Legal advisors from the Vienna-based NOYB organization highlight that repurposing employee communications for AI training without proper consent violates GDPR, even if European employees themselves are not directly monitored. The volume and regularity of data capture suggest that the processing is systematic rather than incidental, which could lead to regulatory action by the Irish Data Protection Commission, Meta’s lead EU privacy supervisor. The case adds to ongoing tensions between Meta and European regulators over data protection and privacy compliance.
Meta’s AI training program relies heavily on detailed data about how employees use various workplace tools, giving it a competitive advantage. However, this approach exposes the company to significant legal risks under GDPR, especially since European employees’ data is being processed without clear safeguards. The outcome of this case may set important precedents for how AI training data involving cross-border communications is handled under European data protection laws.
