AI training on your data: how to object across the EU, service by service

In one sentence: If you live in the EU, you can refuse to let Meta, LinkedIn, OpenAI, Google, Anthropic, Microsoft, Mistral AI and others train their AI on your posts or chats, by switching off a setting or filling in an objection form for each service; at LinkedIn and Anthropic, the refusal covers future training only.

Large language models are trained on vast amounts of text and images. Since 2025, several platforms widely used in Europe have added their own users’ content to that mix, relying on an opt-out rather than on prior consent. This guide explains the EU rule behind your right to refuse, what each company changed, where each switch sits and what regulators have said. It is written for any EU resident; more on privacy and AI regulation in our Society & Law section.

Your right to object, anywhere in the EU

The rule is the same in every Member State: Article 21 of the General Data Protection Regulation (GDPR) gives you “the right to object, on grounds relating to his or her particular situation, at any time” to processing based on a company’s legitimate interests. The controller must then stop, “unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject”. Legitimate interest is the basis Meta relies on for AI training, according to the Irish regulator’s report on Meta, and the one OpenAI cites in its EU privacy policy for training its models: that is why the opt-out mechanisms below exist.

Two other articles of the same regulation matter in practice. Article 12(3) requires the company to tell you what it has done with your request “without undue delay and in any event within one month”, a period that can be extended by two further months for complex cases. Article 77 lets you lodge a complaint with a data protection authority, “in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement”.

The Data Protection Commission (DPC), Ireland’s data protection authority, has spelled out what it expects of an AI opt-out in a report on its supervision of AI published in September 2026. Because it can be very difficult to remove data from a model once it is trained, it writes that there may be no effective way to exercise the right to object if people are not offered the chance before training starts. It also notes that the GDPR makes no distinction between data you gave the company and data it obtained elsewhere: you can object in both cases.

What the platforms changed

Meta (Facebook, Instagram). On 14 April 2025, Meta announced that it would train its AI on “public content —like public posts and comments— shared by adults on our products in the EU”, and on people’s interactions with Meta AI. It states that public data from the accounts of people in the EU under 18 is not used. The CNIL (Commission nationale de l’informatique et des libertés), France’s data protection authority, wrote in a notice in French that the processing was to start at the end of May 2025 and covers both past and future content: public posts by adult users (text, photos, comments) and exchanges with Meta’s AI services, whatever the user’s age. It adds that Meta had clarified that data from Meta AI users on WhatsApp was not concerned.

On private messages, Meta’s announcement says it does not use “the content of your private messages with friends and family to train our AIs, unless you or someone in the chat chooses to share those messages with our AIs”. An update dated 27 March 2026 adds that Meta may train its AI on messages that people choose to share with its AI features.

Because Meta’s European headquarters are in Ireland, the Irish DPC is the authority competent to assess the lawfulness of its processing of personal data, the CNIL notes (in French). In a statement of 21 May 2025, the DPC listed the changes it obtained: updated transparency notices, an “updated and easier to use Objection Form” that works in-app and in all jurisdictions across Europe, access to that form for over a year, and more notice before training. It required Meta to report on the efficacy of its safeguards, a report expected in October 2025, and stated that private posts are not in scope.

LinkedIn. According to its help page on generative AI, LinkedIn updated its European Regional Privacy Notice on 3 November 2025, for members in the “Designated Countries” and the UK, to describe how their data is used to train its generative AI. The categories listed include profile data, posts, articles and comments, group activity and group messages, résumés and screening answers saved to your account, and what you type into its AI features. Private messages are excluded, as is the data of members LinkedIn has reason to believe are under 18.

Anthropic (Claude). On 28 August 2025, Anthropic changed the terms of its consumer plans Claude Free, Pro and Max, including Claude Code used from those accounts, and gave existing users until 8 October 2025 to choose whether their chats could be used to train its models, according to the company’s announcement. If you allow it, data retention rises to five years, against 30 days otherwise. Commercial offers (Claude for Work, Claude for Education, Claude Gov) and the API are not affected.

Other services, including ChatGPT, Gemini, Copilot and Le Chat, also offer a switch to exclude your conversations from training, detailed below.

How to opt out, service by service

The CNIL published a service-by-service sheet in French on 16 October 2025, “sans se prononcer sur la conformité au RGPD des procédés proposés”, that is, without ruling on whether the methods comply with the GDPR (our translation). It describes the French interface. Where the company’s own English help page could be read, the path below follows that page; otherwise it follows the CNIL sheet, with the French label quoted.

• ChatGPT (OpenAI). OpenAI’s EU privacy policy, updated on 24 August 2026, says you can choose in your account’s data controls whether your content is used to train its models. The CNIL sheet points to Settings, then the data controls tab and the option to improve the model for everyone (« Améliorer le modèle pour tous » in the French interface), where you untick the boxes.
• Gemini (Google). Google’s Gemini Apps Privacy Hub says that if you turn off the Keep activity setting in Gemini Apps activity, your future chats “won’t be used to train our AI models, unless you choose to send Google feedback”. They are still kept for 72 hours. Temporary chats are not used to train Google’s models. Chats already reviewed by human reviewers are kept for up to three years even if you delete your activity. The setting name has changed since the CNIL sheet, which also describes an objection request through Gemini’s privacy policy.
• Claude (Anthropic). In the Anthropic Privacy Center: Settings, then Privacy, then the toggle under “Help Improve our AI models”, on desktop, browser or mobile.
• Copilot (Microsoft). Microsoft’s privacy controls page gives the path on copilot.com: profile icon, profile name, then Privacy, where you switch off “Training on conversation activity” and “Training on voice conversations”. Microsoft notes that this page describes the older Copilot app and that an updated app has been available since 18 August 2026; check the privacy menu of the version you use.
• Le Chat (Mistral AI). Mistral AI, a Paris-based company, now calls its assistant Vibe in its help centre. Individual users are not opted out by default. On the web, under Vibe in the admin panel, disable “Allow your interactions to be used to train our models”; in the iOS and Android apps, open Settings, then Data & Account Controls, and deselect “Enable data sharing”. Enterprise customers are opted out by default.
• Meta AI, Facebook, Instagram. According to the CNIL sheet, go to Meta’s rights centre, select the service and log in, choose the option on how to object to the processing of your information, then the form objecting to the use of your information by Meta AI. A second form covers data about you that Meta obtained from third parties. For Meta AI inside WhatsApp, a separate form is reached through WhatsApp’s contact form.
• LinkedIn. The setting is called Data for Generative AI Improvement. The CNIL places it under your account preferences (click your profile photo), in the data privacy tab. LinkedIn also offers a Data Processing Objection form; the CNIL adds that people without a LinkedIn account can use it to object to the use of data about them found on the platform.
• Grok (X). According to the CNIL sheet, untick the option to improve the model (« Améliorer le modèle ») in the data controls tab of Grok’s settings. In the X app, the switch is under privacy and safety, then Grok and third-party collaborators.
• DeepSeek. The CNIL sheet points to the option to improve the model for everyone, in the Profile tab on the web or in data controls in the app. DeepSeek’s privacy policy, last updated on 10 February 2026, lists among the rights that may be available to you “the right to opt-out of using your Personal Data for training our models”. Its data controller is a company registered in China.

The CNIL labels date from October 2025 and interfaces keep changing: check the setting in the app itself.

What regulators have said

The European Data Protection Board (EDPB), which brings together the EU’s national data protection authorities, adopted an opinion on AI models on 18 December 2024, at the request of the Irish authority. It accepts that a conversational agent can rely on legitimate interest, but “only if the processing is shown to be strictly necessary and the balancing of rights is respected”. It adds that a model developed with unlawfully processed personal data could see the lawfulness of its deployment called into question, “unless the model has been duly anonymised”.

On Meta, the CNIL wrote in May 2025 that data protection authorities, itself included, remained mobilised (« mobilisées ») and attentive to Meta’s compliance with the GDPR, in particular on how people can exercise their rights (our translation).

The DPC’s September 2026 report goes back over the Meta case. In 2024, it considered that problems with transparency notices and with the objection form “fundamentally undermined Meta’s reliance of the legitimate interests lawful basis”, and asked for a pause, which Meta respected. In 2025, after further measures, it concluded that there were “no grounds justifying further injunctive regulatory action at that time”, while stating that it was not determining that Meta had complied with the GDPR. The report also lists what it expects of an objection form: easy to access and use, clear on the scope, extent and duration of an objection, and, where applicable, treated as an unconditional and automatically honoured opt-out.

If your objection is ignored

Start with the company: its privacy policy names a contact for data protection requests, and the one-month deadline of Article 12 of the GDPR runs from receipt. OpenAI’s EU privacy policy, for instance, sends EEA residents to the Irish DPC “as our lead supervisory authority”, or to their local authority. Article 77 lets you file with the authority of the country where you live or work; in France, that is the CNIL.

The same reflex applies when a provider leaks data rather than reuses it: our guide to the Notion AI data leak covers the GDPR’s 72-hour breach notification rule, and our guide to AI CV screening shows how the CNIL applies the GDPR to employers’ AI tools. This guide is not legal advice.

A GDPR revision still under discussion

On 19 November 2025, the European Commission published a “Digital Omnibus” proposal that amends several laws, including the GDPR (Regulation 2016/679), according to the procedure file 2025/0360(COD) of the European Parliament’s Legislative Observatory. When consulted on 11 November 2026, the file listed the stage reached as “Awaiting committee decision”, with a committee draft report dated 22 June 2026 and amendments tabled on 27 July 2026. The AI Act changes followed a separate track, covered in our timeline of the EU AI Act.

On 21 October 2026, Member States agreed the Council’s negotiating position, according to The Brussels Times. The paper reports that this position keeps the current definition of personal data and adds safeguards to a proposed derogation that would allow sensitive personal data to be processed for biometric verification and for the development and operation of AI systems. Negotiations with the Parliament will begin once MEPs agree their own position, the Council said. Until a revised text is adopted and published, the current GDPR, including Article 21, continues to apply.

If you run a website, a separate tool concerns your pages rather than your account: the common robots.txt signal to refuse AI training announced by several AI companies (in French).