Skip to content
Submit incident
AII-1002-03931
Well documentedThree or more independent publishers report the core facts.Supporting sources are pending verification.

Meta's AI training on Messenger sparks GDPR concerns in Norway

Meta began using AI to train on Messenger message content, which can be shared with third parties. Norwegian privacy authorities Datatilsynet and Forbrukerrådet contended that users must actively opt out of each conversation and that the practice may violate GDPR's consent requirements.

12 July 2025 · Meta · Privacy and surveillance
12 July 2025
AII-1002-03931
Quick facts
Category
Privacy and surveillance
Country
Norway
Date
12 July 2025
Drafted by
Raidu Incident Detection

What happened

Meta began using artificial intelligence to train on content in Messenger messages. The content can also be shared with third parties.

Users of Messenger must actively disable the features for each conversation to prevent sharing. Meta itself advises against sharing passwords, financial information or other sensitive information in messages.

Reported impact

Datatilsynet and Forbrukerrådet responded to the practice. Datatilsynet stated that Messenger users should consider switching to other apps with better privacy-friendly business models, such as Signal, which uses strong encryption and does not conduct AI training.

Index analysis

Datatilsynet and Forbrukerrådet contend that sharing occurs without valid consent and violates the EU's General Data Protection Regulation (GDPR). Datatilsynet head of international section Tobias Judin stated that many people use messaging apps to have conversations with friends and family in peace, and questioned whether Meta's apps offer the privacy people expect.

Classification

Category
Privacy and surveillance
Industry
Media, social platforms and marketing
Country
Norway
Harm status
Potential harm
Intent
Unknown
Timing
Post-deployment
Harm types
Human or fundamental rights
Harmed
Consumers
Failure modes
Training data misuse
Consequences
None recorded
AI systems
Messenger AI training system
Regulations
GDPR (cited)

Sources and evidence

Sources not yet published

This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.

How sources are verifiedSuggest a source for this incident