On 2 July, the National Data Protection Authority (ANPD), the body that enforces and oversees Brazil’s General Data Protection Law (LGPD), ordered the precautionary suspension of Meta’s new Privacy Policy, which had been in effect since 26 June and allowed data from Facebook, Messenger, and Instagram to be used for AI training. A daily fine of BRL 50,000 was imposed for non-compliance.
The ANPD initiated an ex officio investigation into Meta’s new Privacy Policy after identifying potential violations of the General Data Protection Law (LGPD). This investigation is significant given the large number of Facebook users in Brazil, which totals 102 million (only on Facebook).
The preliminary analysis revealed serious risks to users. The ANPD’s Board of Directors issued the preventive measure, citing factors such as an inappropriate legal basis, unclear privacy policy information, limitations on data subjects’ rights, and risks to children’s and adolescents’ data.
According to the ANPD, Meta did not provide enough information to data subjects about the consequences of processing their data. Additionally, users faced excessive barriers when attempting to oppose the processing of their personal data.
The ANPD found Meta’s reliance on legitimate interest as a legal basis particularly inadequate for sensitive personal data. The authority, grounded in Brazilian law, emphasized that data processing must consider the legitimate expectations of data subjects and adhere to the principles of purpose and necessity.
The ANPD also noted that information on Meta’s platforms is generally shared for personal interactions, not for AI training. The lack of adequate safeguards for data collected from children and adolescents was another key concern.
After Meta requested reconsideration on 10 July, the ANPD decided to uphold the Preventive Measure. The company remains prohibited from implementing its new privacy policy and using personal data for AI training in Brazil.
With the measure still in place, Meta must continue seeking ways to align its practices with LGPD requirements, ensuring the protection of personal data for users in Brazil.
