X in the crosshairs of data protection advocates over AI training with user data

Summary

The data protection organization Noyb has filed complaints against X in nine EU countries. The accusation: X trains its AI systems with personal user data without obtaining consent from those affected.

The data protection organization Noyb has been at odds with tech giants Meta and X (formerly Twitter) for some time over their handling of user data for training AI systems.

In June, Noyb filed complaints against Meta in eleven European countries because the company wanted to use and share personal data such as posts and images with third parties for an undefined “AI technology” – without asking users for consent. Following objections from the Irish Data Protection Authority, Meta subsequently suspended plans for its AI assistant in Europe for the time being.

Now Noyb has set its sights on a new target: The platform X, acquired by Elon Musk, formerly known as Twitter. According to a Reuters report, the data protection organization filed complaints against X with authorities in nine EU countries on Monday.

The accusation: X trains its AI systems with users’ personal data without obtaining their consent. In doing so, the company is violating the European General Data Protection Regulation (GDPR).

With the complaints, Noyb wants to increase pressure on the Irish Data Protection Commission (DPC), which is responsible for regulating most major US internet companies in the EU. The DPC had already sought an order to prohibit or restrict X from processing user data for the development and training of AI systems.

Train and ask questions later

X agreed in court to temporarily refrain from using personal data of EU users collected before users had the opportunity to withdraw their consent for AI training.

However, according to Noyb, the DPC complaint is mainly about damage control and a lack of cooperation from X. The legality of the data processing itself is not being questioned.

“We want to ensure that Twitter fully complies with EU law, which – at a bare minimum – requires to ask users for consent in this case,” explained Noyb founder Max Schrems. An Irish court found that X only gave its users the option to object several weeks after data collection began.

X initially did not respond to a request for comment. The official account for global government affairs stated on Friday that they would continue to work with the DPC on AI issues.

The case is reminiscent of Noyb’s actions against Meta’s AI plans. Here, too, the organization filed complaints in several countries against the use of personal data for software training. Meta subsequently announced in June that it would not launch its AI assistant in Europe for the time being.

These examples show that data protection advocates are highly critical of the use of personal information for training AI systems – and do not shy away from taking legal action against it. For tech companies, this could mean rethinking or at least adapting their AI plans in Europe.