Can Meta and LinkedIn train AI on your posts and photos?

The Magaluf photo dump from 2019. The pint in the beer garden with the one mate who always blinks. The story you posted from the Stansted queue at five in the morning, captioned in language your nan would not sign off on. The Electric Picnic selfie, wellies caked to the knee. All of it lives on Instagram, and every few months the same panic does the rounds: does Instagram own my photos, and is Meta feeding them to its AI? Your photos remain yours. What Instagram holds is a licence to use them. Whether Meta or LinkedIn may also train AI on what you post is a data protection question, and across the UK, Ireland and the rest of Europe the answer is yes, unless you object. The right to object is real, and it works only going forward.

The worry has grounds. Meta said in 2023 that the models behind its first generative AI features were trained partly on public Facebook and Instagram posts. The technical card for Llama 4 also lists public posts from both apps among its training data. Teaching a machine to read or generate images takes billions of examples, and few warehouses are bigger than a social network.

None of this means deleting the app and moving to a cabin in the Cairngorms. The law gives you levers, and which ones you hold depends on which side of the Irish Sea, or which side of the border, you live on.

Does Instagram own my photos?

No. In the UK, the person who takes a photo is the first owner of its copyright, and Irish law says the same. Work done for an employer aside, opening an Instagram account changes none of that.

What you hand over when you sign up is a licence. Picture the valet at a hotel: they can park your car, move it, even let a colleague drive it round to the front, and the logbook stays in your name. The Instagram terms in force in the EU since 1 January 2025 describe that licence like this:

• Non-exclusive. You can still sell the same shot to a magazine or a stock library.
• Worldwide, transferable and sub-licensable. Meta can bring in other companies to run the service.
• Broad. It covers hosting, using, distributing, modifying, copying, displaying, translating and making derivative works.
• Tied to a purpose. It exists to make Instagram work, in line with your privacy and app settings.

The licence ends when your content is deleted from Meta's systems. That takes a while. Deletion can run to 90 days, backups can hold copies for a while longer, and anything someone else already shared under the licence stays where they put it.

Read the list again: the licence never mentions training AI models. The AI question is answered by a different body of law.

If the photos are mine, how can Meta train AI on them?

Your face in a photo, your caption and your comment under a friend's post are personal data, and using them needs a legal basis. Meta, LinkedIn and X all lean on legitimate interests. In plain terms, the company says three things: it has a genuine reason to use the data, it needs the data for that reason, and its reason outweighs your interests once safeguards are in place.

That last step, the balancing test, is where the argument happens. For the EU and the EEA, the European Data Protection Board set out the method in Opinion 28/2024. There must be a real interest, the processing must be necessary, and in the balance your reasonable expectations weigh heavily. Among the safeguards that can tip it, the Board names an unconditional opt-out offered from the start. It also warned that a model trained unlawfully can carry the problem into its later use.

The UK reached a similar place by its own road. The ICO regards legitimate interests as the only realistic basis for training generative AI on data collected at scale. It expects developers to pass all three steps and to be open about what they use. Since 5 February 2026, the Data (Use and Access) Act 2025 has let some recognised legitimate interests skip the balancing test. The list covers national security, emergencies, crime and safeguarding, and AI training is not on it. For a British user's posts, Meta still has to win the balance.

Legitimate interests come with a counterweight. Article 21 of the UK GDPR and its twin in the EU GDPR let you object at any time. The company must then stop unless it shows compelling grounds that override yours. For AI training, the platforms offer a form or a switch, and you do not have to argue your case.

Why does the answer depend on where you live?

Europe has no single rulebook here. Five pieces of the map matter.

Ireland and the rest of the EU. Meta and LinkedIn both run their European operations from Dublin. That makes Ireland's Data Protection Commission the lead authority for both across the EU and the EEA, so what the DPC does, or holds back from doing, is felt from Lisbon to Lapland.

In its statement of 21 May 2025, the DPC listed what Meta changed before training began on 27 May:

• clearer notices;
• a simpler objection form;
• a longer notice period;
• filtering of the training data.

The statement approves nothing. The DPC kept the file open and required Meta to report on its safeguards by October 2025. The outcome of that report has not been published. No authority has declared the training unlawful either. That same month, the Higher Regional Court of Cologne refused to block it in fast-track proceedings.

Great Britain. The UK runs its own system: the UK GDPR, the Data Protection Act 2018 and the ICO, which polices the Meta AI opt-out in the UK. Meta paused UK training in June 2024 at the ICO's request. On 13 September 2024 it announced that it would resume, well ahead of the EU. The ICO's statement that day said plainly that it had given no regulatory approval and would monitor. In October 2026 the ICO reported changes from ten foundation model developers, Meta among them. Each had made or committed to changes on transparency and on how people exercise their rights.

Northern Ireland. It shares an island with Ireland and a rulebook with Great Britain. A photo posted in Belfast falls under the UK GDPR and the ICO, which has an office in the city, even though Dublin is two hours down the motorway. The DPC's remit stops at the border.

Norway, Iceland and Liechtenstein. They apply the GDPR through the EEA Agreement and have their own authorities. Iceland's regulator, for one, published the links to Meta's objection forms when training was announced.

Switzerland. It sits outside the GDPR. Its revised Federal Act on Data Protection, in force since 1 September 2023, does not ask for a legal basis for every use of data. It treats processing against your express wishes as a breach. It also presumes there is none where you made the data public yourself and never objected, so an explicit objection carries even more weight.

• LinkedIn included Swiss members in its November 2025 change.
• X: the Swiss regulator closed its look at X in March 2025, satisfied that users can opt out.
• Meta: its last word on record with the regulator, from June 2024, was that it would not use Swiss data for the time being.

What does Meta use, and what does it leave out?

In the EU and the EEA, Meta trains on public posts and comments from adult accounts. It also trains on people's interactions with Meta AI, the assistant built into Facebook, Instagram, Messenger and WhatsApp. For the UK, its 2024 announcement named public posts, comments, photos and captions from adult users.

Two things stay out:

• private messages with friends and family;
• the public content of accounts held by under-18s.

Since March 2026 Meta has added a caveat: a private chat can enter the training data if someone in it shares it with Meta AI. Its privacy policy also counts what anyone types to the assistant, teenagers included, as material for improving its AI. Private posts are out of scope, the DPC confirmed, so a private account keeps yours out of the next rounds.

What about LinkedIn and X?

Since 3 November 2025, LinkedIn has used profile details and public content to train the AI that writes content on the platform. This covers members in the UK, the EEA and Switzerland, as well as Canada and Hong Kong.

• Legal basis: legitimate interests.
• Left out: private messages, and data from members LinkedIn believes are under 18.
• Opting out also covers LinkedIn's affiliates, Microsoft among them, when they train content-generating models on your data.

On 7 November 2025 the DPC said that LinkedIn had narrowed the data and the time span it draws on. It added that it had neither approved the processing nor found it compliant. The ICO welcomed LinkedIn's clearer notices and simpler opt-out when UK training resumed in September 2025.

X can share your public posts, public profile information and Grok conversations with xAI to train Grok, according to its help page. xAI's privacy addendum for the EEA, the UK and Switzerland, in force since August 2026, rests that training on legitimate interests. Since April 2025 the DPC has had an inquiry open into whether training Grok on EU and EEA users' public posts was lawful.

How do you object to Meta AI training?

Each platform has its own route:

1. Instagram. Go to your profile, open the menu, then Settings and privacy, then the Privacy Centre. Follow the link to object to the use of your information for AI at Meta. The direct form is here.
2. Facebook. Go to Settings and privacy, then the Privacy Centre. Open the section on how Meta uses information for generative AI and choose the right to object. The direct form is here. If you use both apps, object in both.
3. LinkedIn. The AI training opt-out sits in Settings and Privacy, then Data privacy, then Data for Generative AI Improvement: switch it off. LinkedIn also offers an objection form, explained on its help page about the change.
4. X. Go to Settings and privacy, then Privacy and safety, then Data sharing and personalisation, then Grok and third-party collaborators. Untick the box that allows training. X warns that the thumbs-up and thumbs-down you give Grok's answers may still be used.

If a platform ignores you, the next step depends on where you live.

• UK. The ICO asks you to raise the complaint with the company first. Since 19 June 2026 the law has required organisations to make complaints easy to submit and acknowledge them within 30 days, and to tell you the outcome promptly. If that goes nowhere, the ICO takes it from there.
• Ireland. You go to the company first and then to the DPC.
• Rest of the EU and the EEA. Your national authority takes the complaint.
• Switzerland. The FDPIC takes it.

Is it too late to opt out of Meta AI training?

It is worth doing today, with two limits.

The first is time: objecting works going forward. A model does not keep your photos in a drawer you can empty. What it learned is spread across billions of numbers, and there is no button that makes it forget one beach photo. Your objection keeps your posts out of later rounds, and models are retrained often enough for that to matter.

The second is reach: your objection covers your account. The photo from your cousin's wedding, with you on the dance floor in a borrowed tie, lives on your cousin's account and follows their settings. If it is public and they have not objected, it can be used. You can ask them to make it private, untag you or take it down. You can also ask Meta to erase personal data about you, a right that exists in both the EU and the UK.

Photos of children follow the same logic. Meta excludes accounts held by under-18s. The photo of your daughter's nativity play on your public profile, though, is your content, in scope with the rest of your posts.

Where does copyright come in?

Copyright runs in the background, and the argument is loud on both islands.

In the EU, Ireland included, text and data mining of material that is publicly available online is allowed, commercial use included. The exception falls away if the rightholder has reserved their rights in a machine-readable way. Ireland wrote that rule into its copyright act in 2021.

The UK allows mining only for non-commercial research. The government consulted in December 2024 on an EU-style exception with an opt-out. In its report of 18 March 2026 it said that route is no longer its preferred way forward, and it has not chosen another.

For what you post on a social network, the licence you accepted comes first. The platform holds your photos under a permission you gave. Whether that permission stretches to training AI is a question no court in these islands has answered.

The essentials

Your photos belong to you, and the licence you gave Instagram exists to run the app. AI training runs on data protection law: legitimate interests on their side, the right to object on yours. Meta, LinkedIn and X already train on public content from users across the UK, Ireland and the rest of Europe, and no regulator has approved or condemned it. Objecting takes minutes and protects what comes next, so the sooner you do it, the more you keep out.

Frequently asked questions

Does Instagram own my photos?

No. Copyright stays with the person who took the photo, in the UK and in Ireland. Instagram holds a non-exclusive, worldwide licence to host, show and adapt your content while it is on the platform. That licence ends once the content is deleted from Meta's systems.

How do I stop Meta AI using my data in the UK?

Use the objection form in the Privacy Centre of Instagram and the one in Facebook. Once you object, your public posts should stay out of future training. Treat anything you type to Meta AI as usable.

Is it too late to opt out of Meta AI training?

No. Your objection keeps your future posts and your existing public ones out of later training rounds. What a model has already learned cannot be pulled back out, so earlier is better.

Does a private account stop Meta using my photos?

Yes, for future training. The DPC confirmed that private posts are out of scope. Your username and profile photo stay public, and anything already used while the account was public cannot be undone.

Can I object for my child?

Accounts held by under-18s are already excluded from Meta's and LinkedIn's training. Photos of your child on your own public account are your content, so what covers them is your objection, or switching your account to private.

Does posting “I do not give Meta permission” work?

No. The chain posts that circle every few months have no legal effect. The fact-checkers at TheJournal.ie and the UK Safer Internet Centre have both called them a hoax. A post changes neither the terms you accepted nor data protection law. Only the official form or setting works.