The EU Just Fined Meta $1.3 Billion for Training AI on European User Data

The record-breaking GDPR fine targets Meta's use of Facebook and Instagram posts, photos, and messages to train its Llama AI models without adequate user consent.

The Irish Data Protection Commission, acting as the lead EU supervisory authority for Meta, has imposed a record €1. 2 billion ($1. 3 billion USD) fine under the General Data Protection Regulation for Meta's use of European users' Facebook and Instagram data to train its Llama family of AI models without valid consent.

The decision represents the largest GDPR fine to date and establishes precedent that could reshape AI training data practices globally. The investigation focused on Meta's ingestion of posts, photos, comments, stories, and direct messages from Facebook and Instagram users across all 27 EU member states into the training pipeline for its Llama series of large language models. The volume of affected data encompasses content from hundreds of millions of users, much of it collected over a span of more than a decade.

Meta's legal defense relied on GDPR Article 6(1)(f) — the "legitimate interest" basis that allows data processing without explicit consent when the controller's interest does not override the data subject's fundamental rights. Meta has successfully used this provision to justify behavioral advertising for years, and it attempted to extend the same argument to AI model training. The Commission's ruling rejected this extension categorically.

The decision drew a clear distinction between data processing for service delivery or advertising — where personal data is used in a targeted but reversible manner — and A

I model training, where personal data is permanently absorbed into model parameters. The ruling emphasized that trained AI models cannot meaningfully "forget" specific training data, making the processing effectively irreversible. This irreversibility, the Commission argued, fundamentally changes the rights calculus under GDPR and necessitates explicit, informed consent under Article 6(1)(a).

The consent problem is compounded by temporal factors. The majority of the data used in Llama training was collected under terms of service that predated Meta's AI ambitions, some by nearly a decade. Users who posted content in 2014 or 2016 had no reasonable expectation that their data would be used to train AI models.

The Commission found that Meta's subsequent privacy policy updates, while mentioning AI in general terms, failed to meet GDPR's standard for specific, informed consent regarding this particular processing purpose. The remediation order presents perhaps the most legally and technically complex element of the decision. The Commission has ordered Meta to delete all training data derived from EU users and to ensure that future Llama models are not trained on EU personal data without valid consent.

However, the concept of "deleting" data from a trained neural network remains technically unresolved. Current machine unlearning research offers approximate methods but no guarantees of complete removal, and the process can significantly degrade model performance. Meta is expected to argue in its appeal that compliance is technically infeasible, creating an unprecedented legal question about regulatory orders that may exceed current technological capabilities.

Meta has confirmed it will appeal the decision, calling the fine "disproportionate" and maintaining that its legitimate interest basis is legally sound. The appeal process through EU courts could extend over several years. During this period, the Commission retains the authority to impose additional daily penalties of up to 5% of Meta's global daily turnover for non-compliance with the remediation order.

The industry implications are far-reaching. Virtually every major technology company uses some form of user data in AI development. Google leverages data from Gmail, Search, YouTube, and its productivity suite.

Apple processes Siri interactions and on-device behavioral data. Microsoft draws on Office 365 data and LinkedIn content. OpenAI's training data sources remain partially undisclosed.

If the Commission's interpretation — that A

I training constitutes a distinct, irreversible processing purpose requiring separate and explicit consent — becomes established regulatory doctrine, it would require fundamental restructuring of data acquisition pipelines across the industry. Some companies may respond by adopting EU-level consent standards globally, finding it operationally simpler than maintaining region-specific data pipelines. Others may accelerate investment in alternative training data sources: synthetic data generation, licensed content from publishers and data brokers, and proprietary data collection with purpose-built consent mechanisms.

The decision may also strengthen the bargaining position of content creators, publishers, and data licensing intermediaries. The ruling is consistent with the EU's established regulatory trajectory on AI and data rights. Italy's DPA temporarily suspended ChatGPT in 2023 over GDPR concerns.

The EU AI Act, which entered into force in stages from 2024, imposes additional transparency and documentation requirements on AI training data. And the European Data Protection Board has issued guidance increasingly skeptical of legitimate interest claims for AI training. For technology companies operating in the EU, the regulatory direction is unambiguous — and this decision converts that direction into binding, precedent-setting enforcement.

---

The EU Just Fined Meta $1.3 Billion for Training AI on European User Data

Related Reading