Meta’s Use of EU Data for AI Training Upheld by German Court Despite Criticism
The Higher Regional Court of Cologne dismissed an injunction request by the Consumer Protection Organization of North Rhine-Westphalia against Meta’s use of public posts from EU users for AI training. This ruling follows a positive assessment from the Irish Data Protection Authority, which is the lead authority for Meta under the GDPR. Despite this, the Hamburg Data Protection Commissioner remains critical and has initiated urgent proceedings to potentially halt Meta’s AI training involving German data subjects.
Meta announced in mid-2024 that it would use public posts on its platforms, including Facebook and Instagram, for AI training. Users were informed they could object to this use by May 27, 2025. The company relies on the legal basis of “legitimate interest” to process this data unless users opt out. Consumer protection groups argue that Meta should require explicit user consent (opt-in), especially when processing sensitive personal data such as health information. The debate also touches on Meta’s status as a gatekeeper under the Digital Markets Act (DMA), which restricts certain data practices.
The Irish Data Protection Authority approved Meta’s approach after Meta implemented improvements like clearer transparency notices and easier objection procedures. However, the Hamburg Data Protection Commissioner disagrees, questioning the necessity of processing large volumes of data and the effectiveness of Meta’s risk mitigation measures. The commissioner also raised concerns that public posts are not truly public if access requires logging in and that historical data use for AI training was not foreseeable to users when originally posted.
The Cologne court ruled that Meta’s legitimate interests outweigh the rights of data subjects, given the measures Meta has taken to reduce privacy risks. The court also found no unlawful combination of personal data under the DMA. The case highlights ongoing uncertainty in EU data protection law regarding AI training and personal data. Companies should ensure careful data preparation and protective measures while closely collaborating with legal experts to navigate these challenges.
