Across Europe, the biggest social platforms do not ask for explicit consent before training their artificial intelligence models on what you publish. Instead, they rely on legitimate interest under the General Data Protection Regulation and give users a right to object — a right each company has implemented in its own way. Meta offers a form, LinkedIn a toggle, X a paragraph buried in its privacy policy, and Google effectively nothing for the average user. The critical caveat: objecting only works going forward. Data already used to train a model cannot be “untrained.”
- Legal basis: Article 6(1)(f) of the GDPR lets companies process personal data for legitimate interests, while Article 21 grants a right to object at any time.
- Platform-by-platform: Meta uses a form, LinkedIn a settings toggle plus a separate form, X relies on its privacy policy, and Google offers only a web-crawler token for site owners.
- No retroactive fix: None of the sources consulted promises to remove your data from an already-trained model, and the European Data Protection Board warns such models are not necessarily anonymous.
The legal foundation: objection, not consent
Article 6(1)(f) of the GDPR permits processing when it is necessary for a company’s legitimate interest, provided the rights of the individual do not override it. The European Data Protection Board examined how that basis applies to AI training in its Opinion 28/2024, adopted on 17 December 2024. Three points matter for users. First, a model trained on personal data cannot be considered anonymous in every case; it must be assessed individually. Second, the person’s reasonable expectations count when weighing legitimate interest — whether the data was public, which service it was posted on, and what privacy settings were available. Third, the Board suggests measures such as leaving a reasonable interval between collection and use, offering an unconditional opt-out from the outset that goes beyond Article 21, and allowing erasure even where Article 17 conditions are not met.
Those measures help explain why nearly every platform provides a form or a setting. It is less generosity than what keeps their legitimate interest defensible under scrutiny.
Meta, LinkedIn and X: three different doors
Meta trains on the public content of adults and on what people ask Meta AI, and it allows objections through a form. Its 14 April 2025 announcement covered public posts and comments from adults in the EU plus interactions with Meta AI, with in-app and email notices linking to an objection form usable at any time. Meta also promised to honour earlier objections. It says it does not use public data from accounts belonging to users under 18 in the EU, nor the content of private messages between friends and family — though a 27 March 2026 update adds a nuance: it may train on messages that someone in a chat chooses to share with its AI features.
LinkedIn provides a toggle called “Data for generative AI improvement.” Disabling it stops the use of your data for training from that point on, but does not affect training already completed. It draws on your profile, posts, articles, comments, group activity, uploaded résumés and what you write in its AI features. It does not use private messages, credentials, payment data or data from users it believes are in secondary school. Two gaps are worth knowing: comments and ratings you give LinkedIn about its features, including thumbs up or down, are not covered by the toggle and require its data-processing objection form; and the toggle covers content-generating models only, so other AI and machine-learning models also require the form. LinkedIn updated its European privacy notice on 3 November 2025.
X states in its privacy policy, in force since 15 January 2026, that it may use the data it collects and public information to train its AI models. The policy adds that, unless you opt out, third parties with whom it shares data may use it for their own purposes, including training generative or other AI models. In the EU, the controller is X Internet Unlimited Company and the lead authority is the Irish Data Protection Commission. The policy does not specify which setting exercises that exclusion, nor does it name Grok. The legal route still exists: Article 21 can be exercised through the contact channels the policy lists, and if there is no response it points to the Irish regulator. Objections can also be filed with the supervisory authority of the member state where you reside, as Article 77 allows.
Google: no button for your public data
Google says it may collect publicly available information on the internet to train its AI models, and its privacy policy describes no individual setting to exclude yourself from that. The policy, in force since 16 October 2026, cites Translate, the Gemini apps and Cloud AI features as examples. The specific control Google documents is aimed at website owners: the Google-Extended token in a robots.txt file lets them decide whether crawled content may be used to train future generations of Gemini, and Google says it does not affect Search appearance. What Gemini does with your emails is a separate setting, as are the controls governing what chatbots remember between conversations.
Objecting also does not settle who owns what AI produces — that is a copyright question, not a data-protection one. The asymmetry is the most revealing part: LinkedIn documents in detail what it uses, Meta explains its limits in a press release, X dispatches it in a paragraph, and Google pushes control to website owners. None of the sources consulted promises to remove your data from a model already trained, and the European board reminds us those models are not necessarily anonymous. If it matters to you, object now: every month of delay is another month of posts inside.