ANPD Suspends the Processing of Data for AI Training by Meta in Brazil

The Brazilian Data Protection Authority (“ANPD”) has ordered the suspension of Meta’s data processing activities for AI training in Brazil in its platforms Facebook, Instagram, and Messenger. The decision was published in the Official Gazette last Tuesday (2) and stipulates a daily fine approx. USD 10,000.00 for non-compliance due to the “imminent risk of serious, irreparable, or hard-to-repair damage to the fundamental rights of the affected data subjects”.

The decision was rendered by the ANPD Board of Directors and signed by the Authority’s President, Mr. Waldemar Gonçalves. The investigation process was initiated ex officio by the Authority, without any third-party provocation, after identifying signs of violations of the Brazilian Data Protection Regulation (“LGPD”). Meta began to process user’s data from its platforms to train its generative AI (e.g., Llama model) on June 26, when it updated its Terms of Use.

In a preliminary analysis, ANPD indicated that Meta’s new policies pose significant risks to user rights, including the inappropriate use of a legal basis for data processing, lack of clarity and accessibility of information provided to users about the policy, limitations on the exercise of data subject rights, and inadequate processing of children’s and adolescents’ data.

The Authority has granted Meta five days to present documentation that evidence the changes to its policies, excluding the processing of personal data for training generative artificial intelligence systems. Additionally, the company must submit a declaration signed by its legal representative attesting to the suspension of such use of the data.

The Institute for Consumer Defense (IDEC) has also notified the ANPD, the Public Safety’s National Consumer Bureau (Senacon), and the Administrative Council for Economic Defense (CADE) to investigate and suspend Meta’s policies regarding the LGPD and the Consumer Defense Code (“CDC”). ANPD emphasized that Meta did not provide adequate information for users to understand the consequences of their data as a material for AI development, highlighting that the information shared on the platforms is generally intended for personal use, not for training AI systems.

In response to the ANPD’s decision, Meta expressed its disappointment, emphasizing that its practices comply with Brazilian laws and privacy regulations. The company reaffirmed its commitment of cooperation with ANPD to address any concerns raised and scrutinized that AI training is not exclusive to its services. It also stated that Meta maintains a level of transparency superior to many competitors.

On the one hand, we have Meta defending its technological advancement, and on the other, ANPD seeking transparency and compliance with regulations. This is the first direct action by the Authority targeting big tech companies. Director Miriam Wimmer has stated that this decision will serve as a benchmark for the Authority’s guidance on issues related to Artificial Intelligence.

Our Digital Law team is closely monitoring all developments on this matter and its impacts on the Brazilian landscape. If you wish to receive more information on the topic, we are available via email at digital@kasznarleonardos.com.