Training Data from Meta Platform User Interactions

What it is

The card discloses that both Llama 4 Scout and Llama 4 Maverick were pretrained on data that includes publicly shared Instagram and Facebook posts and recorded interactions between users and Meta AI.

Why it matters (compliance & governance perspective)

This provision discloses that identifiable categories of user-generated content and AI interaction logs from Meta's consumer platforms were incorporated into model pretraining. Organizations deploying Llama 4 in jurisdictions with data protection requirements should assess whether this training data disclosure creates due diligence obligations under applicable privacy law.

Consumer impact (what this means for users)

This provision establishes that individuals who shared content publicly on Instagram or Facebook, or who interacted with Meta AI prior to August 2024, may have had those interactions included in Llama 4's pretraining dataset. The document references Meta's Privacy Center for additional information but does not specify a mechanism for individuals to exclude their data from model training.

What you can do

Institutional analysis (regulatory & governance intelligence)

(1) REGULATORY LANDSCAPE: The disclosure that training data includes user interactions with Meta AI and publicly shared social media posts engages GDPR provisions on lawful basis for processing personal data in AI training contexts, as well as CCPA provisions on use of personal information. The European Data Protection Board and national EU supervisory authorities have issued guidance on the use of publicly available data for AI training that may be relevant. The FTC retains authority over data practices under the FTC Act. (2) GOVERNANCE EXPOSURE: Medium. The disclosure identifies specific categories of user-generated data used in training but does not specify the legal basis for processing, the volume of personal data involved, or the mechanism by which users could object to or opt out of inclusion. This creates a documentation gap that may require assessment under GDPR Article 13/14 transparency obligations and CCPA disclosure requirements. (3) JURISDICTION FLAGS: EU and EEA jurisdictions create heightened exposure given GDPR requirements on lawful basis and data subject rights. California residents may have CCPA-based interests depending on the classification of training data use. The UK GDPR and ICO guidance on AI and data protection are also relevant for UK-facing deployments. (4) CONTRACT AND VENDOR IMPLICATIONS: Organizations procuring Llama 4 for enterprise deployment should assess whether the training data disclosure requires disclosure to their own end users under applicable privacy notices. Vendor data processing agreements may need to address the provenance of model training data where downstream products process personal data using Llama 4. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should review whether existing privacy notices adequately disclose the use of AI models trained on user-generated platform data. A data protection impact assessment may be warranted for EU-facing deployments. Legal teams should monitor regulatory guidance on the lawful basis for using social media and AI interaction data in foundation model training, as this area is subject to active regulatory development.

Applicable agencies

Provision details

Other risks in this policy

• Developer Responsibility for Safety Testing high
• Out-of-Scope Language and Image Use medium
• Acceptable Use Policy and License Restrictions medium
• Greenhouse Gas Emissions and Energy Disclosure low
• System-Level Protections Recommendation medium
• Red Teaming and Critical Risk Evaluation low