Carlos Lopez By Carlos Lopez

Privacy & Data · European Union · AI

How to Object to AI Training With Your Personal Data: GDPR Rights and the EU AI Act

You discover a platform may use your posts, images or other personal data in AI development. The answer is not a universal AI Act opt-out: the correct route depends on the GDPR legal basis and the service's actual processing.

The GDPR and the AI Act Do Different Jobs

The GDPR governs the processing of personal data. The AI Act regulates artificial-intelligence systems and, among other things, imposes obligations on providers of general-purpose AI models. The AI Act does not create a universal consumer right to switch off all AI training that uses personal data.

The EDPB's Opinion 28/2024 specifically examines personal-data processing in the development and deployment of AI models, including when legitimate interests can be used as a legal basis and what happens where a model was trained using unlawfully processed personal data.

Article 21 Is Powerful — But It Depends on the Legal Basis

Where processing is based on legitimate interests or a task carried out in the public interest, Article 21 GDPR gives individuals a right to object on grounds relating to their particular situation. The controller must stop processing unless it demonstrates compelling legitimate grounds that override the individual's interests, rights and freedoms, or needs the data for the establishment, exercise or defence of legal claims.

For direct marketing, the right to object is stronger: processing for direct marketing must stop when the individual objects.

If the controller relies on consent instead, the relevant tool may be withdrawing consent rather than an Article 21 objection.

Private Messages Are Not Automatically Outside the GDPR

Whether content is private or publicly visible can affect the legal analysis, but both can constitute personal data. The real questions include who controls the processing, the purpose, the legal basis, whether special-category data is involved and whether the processing is necessary and proportionate.

What the AI Act Adds

The AI Act requires providers of general-purpose AI models to maintain technical documentation about training and testing and to put in place a policy to comply with EU copyright law, including respecting rights reservations where applicable. These obligations do not replace GDPR rights for individuals whose personal data is processed.

The AI Act's provisions entered into application on a staged timetable. An August 2026 article should therefore identify the particular obligation and effective date instead of saying "the AI Act is now fully in force".

How to Make the Objection Useful

  1. Identify the controller and the service.
  2. Ask which personal data is processed for AI development or deployment.
  3. Ask for the Article 6 legal basis and the stated purpose.
  4. If legitimate interests are relied upon, expressly exercise your Article 21 right to object.
  5. If consent is the basis, withdraw consent where applicable.
  6. Keep the request, acknowledgement and response.

Do Not Promise a Universal "AI Training Opt-Out"

Some platforms provide specific settings or forms, while others may analyse Article 21 objections individually. The legal effect therefore depends on the controller's basis for processing and the nature of the data and purpose.

What This Means Practically

Sources