Meta's AI Training Pause in the EU: What GDPR Compliance Really Requires for AI Developers

In a significant development for AI governance, Meta has committed to the Irish Data Protection Commission (DPC) to pause training its large language models on EU/EEA user data. This decision follows 11 coordinated complaints filed by noyb (the European Center for Digital Rights) and pressure from other EU data protection authorities. The case underscores the intense scrutiny AI developers face under the GDPR, particularly when relying on legitimate interest as a legal basis for processing personal data for AI training. This article examines the legal and regulatory landscape, the implications for other AI companies, and provides a practical compliance checklist.

The Legal Basis for AI Training: GDPR Article 6(1)(f) and the 'Reasonable Expectations' Test

Under the GDPR, processing personal data requires a valid legal basis. Many AI developers have sought to rely on legitimate interest (Article 6(1)(f)) for training models on user data, arguing that it is necessary for product improvement and innovation. However, this basis is not a free pass. It requires a balancing test: the controller's legitimate interest must not be overridden by the data subject's interests, rights, or freedoms.

A critical factor is the 'reasonable expectations' test—whether individuals would reasonably expect their data to be used for AI training. The European Data Protection Board (EDPB) has emphasized that transparency and context are key. If users provided data for a specific service (e.g., social networking), using it to train a general-purpose AI model may fall outside their reasonable expectations, especially without explicit consent or a clear opt-out.

noyb's complaints argue that Meta's processing lacks a valid legal basis because it does not obtain opt-in consent and fails to meet the reasonable expectations test. The Irish DPC initially approved Meta's plans but reversed its position after pushback from other DPAs, demonstrating the lack of consensus on this issue.

Sequence of Events: noyb Complaints, DPC U-Turn, and Meta's Pause

The saga began when noyb filed 11 complaints across multiple EU jurisdictions against Meta's planned use of user data for AI training. noyb, led by Max Schrems, has a track record of high-impact GDPR litigation (e.g., Schrems II). The complaints were coordinated to trigger action from the Irish DPC, Meta's lead supervisory authority under the GDPR's one-stop-shop mechanism.

Initially, the Irish DPC seemed to accept Meta's reliance on legitimate interest. However, after other DPAs (notably from Germany and France) expressed concerns, the DPC asked Meta to pause its plans. Meta ultimately committed to pausing training on EU/EEA user data. noyb welcomed the pause but noted that Meta's privacy policy has not been officially changed, so the commitment is not legally binding. The announcement was made late on a Friday, which noyb suggests was an attempt to minimize media coverage.

This episode highlights the tension between big tech and EU privacy regulators and the risks of relying solely on legitimate interest for AI training.

Implications for Other AI Developers: OpenAI, Google, Anthropic

Meta's pause sends a clear signal to other AI developers training on EU data. Companies like OpenAI, Google, and Anthropic must reassess their compliance strategies. While they may have different data sources and processing contexts, the core issue remains: is legitimate interest sufficient for AI training?

Regulators are increasingly skeptical. The EDPB's guidance on the interplay between GDPR and AI is still evolving, but the trend is toward requiring stronger safeguards: explicit consent, robust opt-outs, or anonymization. Developers should consider:

• Obtaining opt-in consent where feasible, especially for sensitive data or when training general-purpose models.
• Implementing clear opt-out mechanisms that are easy to use and honored retroactively.
• Conducting and documenting a Legitimate Interest Assessment (LIA) to demonstrate compliance.
• Enhancing transparency by updating privacy notices to specifically mention AI training.

Failure to address these points could lead to regulatory action and fines up to €20 million or 4% of global turnover under GDPR.

EU AI Act Data Governance Requirements (Article 10)

The EU AI Act (Regulation (EU) 2024/1689) introduces additional obligations for high-risk AI systems, including data governance requirements under Article 10. These include:

• Data quality and relevance: Training, validation, and testing datasets must be relevant, sufficiently representative, and free from errors.
• Data governance: Organizations must implement appropriate data governance and management practices, including data collection, processing, and documentation.
• Bias mitigation: High-risk AI systems must be developed with measures to detect and mitigate biases.
• Data protection impact assessments (DPIAs): While not explicitly required by Article 10, DPIAs are a GDPR obligation and complement AI Act compliance.

For AI systems classified as high-risk under the AI Act (e.g., in employment, education, or critical infrastructure), these requirements are mandatory from 2 August 2026. Even for non-high-risk systems, the AI Act's transparency obligations (e.g., disclosing AI-generated content) apply from 2 August 2026.

Organizations should integrate GDPR and AI Act compliance efforts. For example, a DPIA can inform the AI Act's risk management system, and the AI Act's data governance requirements can strengthen GDPR accountability.

Compliance Checklist for AI Developers Training on EU Data

To navigate this complex landscape, AI developers should implement the following measures:

1. Conduct a Data Protection Impact Assessment (DPIA): Required under GDPR Article 35 for large-scale processing or high-risk activities. A DPIA should assess the necessity and proportionality of AI training, identify risks, and outline mitigation measures.
2. Prepare a Legitimate Interest Assessment (LIA): Document the legitimate interest, necessity, and balancing test. Be honest about potential impacts on data subjects and consider alternatives like consent or anonymization.
3. Implement opt-out mechanisms: Provide users with a clear and accessible way to opt out of AI training. Honor opt-outs promptly and ensure data is excluded from future training.
4. Update transparency notices: Clearly explain in privacy policies what data is used for AI training, the legal basis, and how users can exercise their rights.
5. Maintain records of processing: Under GDPR Article 30, keep detailed records of processing activities, including purposes and legal bases.
6. Map AI Act requirements: Determine if your AI system is high-risk under the AI Act. If so, ensure compliance with Article 10 data governance and other obligations.
7. Engage with regulators: Proactively consult DPAs, especially if your processing involves novel technologies or large-scale data.

Tools like AIGovHub can help automate DPIA workflows and map AI Act compliance requirements. AIGovHub's AI governance platform offers interactive tools such as the AI Act Risk Classifier and DPIA generator, enabling organizations to streamline compliance.

Documenting Lawful Basis for Model Training: Risks of Relying Solely on Legitimate Interest

While legitimate interest can be a valid basis, it is not without risks. Regulators may challenge the balancing test, especially for AI training that involves large-scale data and potential societal impact. The Meta case shows that DPAs are willing to intervene. To mitigate risks:

• Be specific: Clearly define the legitimate interest (e.g., improving model accuracy) and demonstrate why consent is not feasible.
• Minimize data: Use only the data necessary for training and consider anonymization or pseudonymization.
• Provide opt-outs: Even if relying on legitimate interest, offering an opt-out can strengthen your position by respecting user autonomy.
• Document everything: Keep records of your LIA, DPIA, and decisions. This will be crucial if challenged.

Relying solely on legitimate interest without robust safeguards invites scrutiny. A hybrid approach—combining legitimate interest with opt-outs and transparency—may be more defensible.

Practical Steps for Compliance Teams

Compliance teams at AI companies operating in the EU should take the following steps:

1. Review data flows: Map all personal data used for AI training, including sources and jurisdictions.
2. Assess legal basis: Evaluate whether legitimate interest is appropriate or if consent is needed. Consider the reasonable expectations of users.
3. Update policies: Revise privacy notices and internal policies to reflect AI training practices.
4. Implement technical measures: Use tools for data minimization, anonymization, and opt-out management.
5. Train staff: Ensure relevant teams understand GDPR and AI Act requirements.
6. Monitor regulatory developments: Stay informed about DPA decisions and EDPB guidance.
7. Leverage compliance tools: Platforms like AIGovHub provide automated DPIA generation, AI Act compliance mapping, and regulatory alerts to streamline compliance.

For a deeper dive into AI Act compliance, see our EU AI Act Compliance Roadmap.

Key Takeaways

• Meta's pause on AI training in the EU highlights regulatory skepticism toward legitimate interest as a sole basis for processing user data for AI.
• noyb's complaints and the Irish DPC's reversal demonstrate the power of coordinated enforcement and the importance of the 'reasonable expectations' test.
• AI developers should consider opt-in consent, robust opt-outs, and thorough documentation (DPIA, LIA) to mitigate risks.
• The EU AI Act's data governance requirements (Article 10) add another layer of compliance for high-risk AI systems, effective from 2 August 2026.
• Compliance teams should integrate GDPR and AI Act efforts and use tools like AIGovHub to automate assessments and stay ahead of regulatory changes.

Conclusion: Proactive Compliance is Key

The Meta case is a wake-up call for AI developers. Relying on legitimate interest without robust safeguards is increasingly untenable in the EU. By adopting a proactive, transparent approach—obtaining consent where necessary, implementing opt-outs, and documenting assessments—companies can navigate the complex regulatory landscape. As the EU AI Act's obligations phase in, integrating data protection and AI governance will be essential. Tools like AIGovHub's AI governance platform can help organizations automate DPIAs, map AI Act requirements, and maintain compliance. To assess your organization's readiness, try AIGovHub's AI Act Risk Classifier and explore our best AI governance platforms.

This content is for informational purposes only and does not constitute legal advice.