The Enterprise AI Failure Casebook

Brazil's data protection authority ordered Meta to stop training its AI on Brazilians' data

Brazil's ANPD suspended Meta's use of Facebook and Instagram data to train generative AI, then lifted the suspension two months later once Meta agreed to notify users, simplify the opt-out and leave out minors' accounts.

Meta Platforms, Inc. · July 2, 2024 · Updated October 31, 2026

On June 26, 2024, a new Meta privacy policy took effect in Brazil. It covered the "Meta Products," including Facebook, Messenger and Instagram. It allowed Meta to use publicly available information and content that users shared, including posts, audio and images, to train and improve its generative AI systems. It also reached people who did not use the platforms, such as someone who appears in a photo a user posted. In Brazil, Facebook alone had about 102 million active users.

Brazil's Autoridade Nacional de Proteção de Dados (ANPD), since renamed the Agência Nacional de Proteção de Dados, opened an inspection on its own initiative. Director Miriam Wimmer wrote the opinion, Voto nº 11/2024, and signed it on July 1, 2024. It set out four preliminary findings.

The first concerned the legal basis. Meta's privacy center said that in Europe and the United Kingdom it relied on legitimate interests. The opinion reasoned that Meta must be relying on the same basis in Brazil, since no other basis in Brazilian law seemed to apply and Meta had not sought consent. It noted that Brazil's data protection law, the LGPD, does not allow legitimate interest for sensitive data, and that photos, audio and text can reveal political, religious and sexual affiliations. For other data, the opinion found that people share posts on Meta's platforms to keep in touch with friends, community and businesses. On a preliminary view, they would not expect that information, "including that shared many years ago," to be used "to train AI systems, which had not even been implemented when the information was shared" (our translation).

The second and third concerned what users were told and how they could refuse. In the European Union, Meta had notified users in advance by email and in the app. The opinion found that Meta's announcement of the update in Brazil was "considerably more limited" (our translation). Objecting took eight clicks in the Facebook app, according to a tutorial the opinion cited. The ANPD's technical staff said the complexity "resembles a dark pattern of masking information" (our translation). The opinion noted that Meta had described its European objection form as three clicks away.

The fourth concerned children. Photos, videos and posts of children and teenagers could be used for training. Meta had announced that in Europe it was not training its Llama models on content from accounts of users under 18. The opinion found no sign of the same caution for Brazil. It also warned that once personal data had trained a model, removing it could be technically difficult.

On July 2, 2024, the ANPD's Board of Directors published Despacho Decisório nº 20/2024. It ordered Meta to suspend in Brazil the part of its policy on AI training and all processing of personal data for that purpose, including data on non-users, with a daily fine of 50,000 reais for noncompliance. Meta had five business days to prove compliance. The opinion stated that the findings were preliminary and that the inspection would examine the conduct in detail.

Meta asked for reconsideration on July 5. It told the ANPD on July 9 that it had suspended the policy changes in Brazil. On July 10, the Board kept the measure, gave Meta five more days to prove it had stopped the processing, and asked for a compliance plan with a timetable. Meta filed a legitimate-interest balancing test, a data protection impact assessment and, on August 9, an updated plan.

On August 30, 2024, the Board approved the plan in Despacho Decisório nº 33/2024 and suspended the preventive measure, on condition that Meta carry out the plan in full. Facebook and Instagram users would get a notice in the app and by email at least 30 days before Meta began using their public data. Users and non-users would get a simpler form to object. Meta would not use data from accounts of users under 18 until the ANPD reached a final decision in its inspection. The Board told its inspection staff to monitor the plan and the launch of Meta's AI system. The approving opinion said the decision did not necessarily confirm legitimate interest as a legal basis for training generative AI, and that the inspection staff still had to examine it. In October 2026, the ANPD still listed the inspection among those in progress.

What failed

Meta changed how it used the personal data of people in Brazil, where Facebook alone had about 102 million active users, through a policy update, on what the ANPD inferred was the legal basis it used in Europe. The ANPD's preliminary view was that Brazilian law did not allow that basis for the sensitive data in users' posts. It also found that Meta had told Brazilian users far less than European users, made objecting harder, and shown no sign of leaving out minors as it did in Europe. Meta's compliance plan added advance notice, a simpler objection form and the exclusion of minors' accounts, and the Board made the plan a condition of lifting the suspension. Whether legitimate interest can support AI training under Brazilian law is a question the ANPD said remained open.

Sources

1. Autoridade Nacional de Proteção de Dados, Voto nº 11/2024/DIR-MW/CD (Portuguese), paras 3.3(v), 4.8, 4.10, 4.11 to 4.13, 4.21 to 4.23, 4.25, 4.28, 4.38, 4.40 to 4.42, 4.48, 4.55, 4.64, 4.74, 5.1; signature block, p. 23
2. Autoridade Nacional de Proteção de Dados, Despacho Decisório nº 20/2024/PR/ANPD, Diário Oficial da União, July 2, 2024 (Portuguese), Section 1, p. 180, operative paragraph and items (a) and (b)
3. Autoridade Nacional de Proteção de Dados, ANPD determina suspensão cautelar do tratamento de dados pessoais para treinamento da IA da Meta (news release, July 2, 2024, Portuguese), paras 1, 3 and 4
4. Autoridade Nacional de Proteção de Dados, Após pedido de reconsideração, ANPD mantém Medida Preventiva aplicada à Meta (news release, July 10, 2024, Portuguese), paras 1 to 3
5. Autoridade Nacional de Proteção de Dados, Voto nº 23/2024/DIR-JR/CD, Circuito Deliberativo nº 18/2024 (Portuguese), paras 3.5, 3.8 to 3.13, 4.1, 4.20, 4.24, 4.27, 4.60
6. Autoridade Nacional de Proteção de Dados, Despacho Decisório nº 33/2024/PR/ANPD, Diário Oficial da União, August 30, 2024 (Portuguese), Section 1, p. 289, operative paragraph and paras 2 to 5
7. Autoridade Nacional de Proteção de Dados, Meta cumpre exigências da ANPD e poderá retomar, com restrições, o uso de dados pessoais para treinamento de inteligência artificial (news release, August 30, 2024, Portuguese), paras 1, 3 to 7
8. Agência Nacional de Proteção de Dados, Saiba como fiscalizamos: Processos de Fiscalização em Andamento (Portuguese), table of inspections in progress, row for Meta Platforms, Inc., process 00261.004509/2024-36
9. Agência Nacional de Proteção de Dados, Plano de Gestão Anual 2026 (Portuguese), Introdução (transformation into the Agência Nacional de Proteção de Dados)