Meta
What Meta commits to on training use, retention, residency and DPA terms, with a model inventory keyed to AI Act deadlines.
Governance and contractual terms
- Training use (default)
- Meta AI: yes, by default — public posts and comments, plus interactions with Meta's AI features, are used to train, on a legitimate-interests legal basis for EU/UK users. EU training was paused in 2024 pending regulatory clarity and resumed the week of 14 April 2025. Meta Model API, paid tier: no — content from Paid Services is contractually excluded from training. Meta Model API, unpaid tier: yes — users are warned not to submit sensitive, confidential or personal information to it. Llama open-weight models: not applicable — Meta has no visibility into or processing role over self-hosted use.
- Retention
- Meta AI: no fixed period — Meta states it keeps training data 'for as long as we need it on a case-by-case basis.' Meta Model API (paid and unpaid): same case-by-case pattern, retained as needed for service delivery, legal compliance and policy review.
- Opt-out
- Yes, for Meta AI — an objection form covering public-post/comment data and AI-feature interactions, confirmed live EU-wide from 27 May 2025 per Ireland's Data Protection Commission. It's prospective only: objecting after a training run has started doesn't remove your data from that run, only future ones.
- Data residency
- Not offered for Meta AI — no data-residency commitment was found in its Terms of Service or Privacy Policy. For the Model API, residency is effectively moot in the EU's favor for the wrong reason: the Paid Services are stated to be available only within the United States, and the unpaid tier explicitly excludes EU end users entirely.
- Sub-processor list
- A general enterprise/B2B sub-processor list exists for the Model API tier (referenced from the Model API terms, hosted at forwork.meta.com/legal/mfw-subprocessor-list/, dated effective 13 November 2023 at last check) but it is not AI-specific. No sub-processor list exists for the free Meta AI consumer product.
- DPA available
- Not applicable to the free consumer Meta AI product — no processor relationship exists. For the Model API's Paid Services, yes: governed by Meta's standard 'Meta Global Processor Terms,' incorporated by reference, which also states Meta will not use Paid Services content to train its models. The Unpaid Services carry no DPA protection. Not applicable to Llama open-weight downloads, which involve no processing relationship with Meta at all.
- Contracting entity
- Meta AI (non-EU/UK/Brazil): Meta Platforms, Inc. Meta AI (EU): Meta Platforms Ireland Limited. Llama open-weight license: no processing relationship exists — the license itself, not a services contract, governs use.
- EU contracting entity
- Meta Platforms Ireland Limited, confirmed current in both the EU AI Terms of Service and the Model API terms. No announced restructuring away from this entity was found.
- Governing law
- Meta AI, EU business use: Irish courts, Irish law. Llama license, all licensees globally: California law, California courts — this applies even to EU-based users of the open-weight models, since the license itself (not a services contract) is what binds them.
- Certifications
- Unverified
- AI Act Code of Practice
- no
- Vulnerability disclosure
- Yes — Meta's Bug Bounty Program (bugbounty.meta.com) explicitly lists reports about Meta's large language models in scope, including issues that could leak or extract training data.
- Documented incidents
- One confirmed, dated vulnerability, though in third-party open-source tooling rather than a Meta-run service: CVE-2024-50050, an unsafe pickle-deserialization flaw in the open-source llama-stack framework enabling remote code execution against a Llama inference server, published 23 October 2024 and patched in llama-stack v0.0.41. Severity ratings varied by source (6.3 in the GitHub Advisory Database, 9.3-9.8 per independent researchers). No other confirmed, dated incident was found — unverified secondary reports of a Llama model leak were excluded.
Model inventory
Listed by the AI Act deadline each model falls under, which depends on when it was placed on the EU market rather than on its capability. No benchmark scores — why not.
| Model | API identifier | EU availability | AI Act deadline | Covered by DPA |
|---|---|---|---|---|
| Llama 4 Scout Multimodal rights under the license are withheld from individuals or companies domiciled in the EU. | — | 5 April 2025 | 2 Aug 2027 | Not applicable — open-weight license, not a hosted service |
| Llama 4 Maverick Same EU multimodal-rights restriction as Scout. | — | 5 April 2025 | 2 Aug 2027 | Not applicable — open-weight license, not a hosted service |
| Llama 3.3 Text-only; the EU multimodal restriction doesn't apply to this release. | — | 6 December 2024 | 2 Aug 2027 | Not applicable — open-weight license, not a hosted service |
| Llama 3.1 | — | 23 July 2024 | 2 Aug 2027 | Not applicable — open-weight license, not a hosted service |
Who you are contracting with
Meta AI splits by region like the other US providers: Meta Platforms, Inc. outside the EU/UK/Brazil, Meta Platforms Ireland Limited inside the EU, per Meta’s own AI Terms of Service. Llama is different in kind, not just degree — downloading and running an open-weight model creates no services relationship with Meta at all, so there’s no “which entity are you contracting with” question in the usual sense. What binds a Llama user is the license itself, and that license specifies California law and courts for every licensee globally, including ones based in the EU.
Training use and retention
Meta AI trains on public posts, comments, and your interactions with its AI features by default, on a legitimate-interests basis for EU and UK users. That EU training was actually paused for most of 2024 while regulators sought clarity, and only resumed the week of 14 April 2025 — worth keeping in the record as context for how contested this specific practice has been in Europe. An EU-wide objection form went live alongside the resumed rollout (confirmed by Ireland’s Data Protection Commission as of 27 May 2025), but it only stops future training runs — data already used in a run that’s started stays used.
The Model API, launched 8 July 2026, currently serves a single closed model (Muse Spark, not a Llama model) and splits training use by payment: paid requests are contractually excluded from training, unpaid requests are not, and Meta’s own terms warn users not to submit sensitive or personal data to the unpaid tier.
Residency and sub-processors
This is the shortest section for Meta because the offering itself is narrower than the other four providers’: no EU data-residency commitment exists for Meta AI, and the Model API’s Paid Services are stated to be available only within the United States — meaning EU customers currently can’t access the paid, better-governed tier of Meta’s own hosted AI product at all. A general Model API sub-processor list exists but isn’t AI-specific, and no equivalent list exists for the free Meta AI product.
Certifications
None found specific to Meta AI or Llama in this research pass. Meta does hold certifications (ISO 27001, ISO 27018, SOC 2, SOC 3) for a separate product, Horizon Managed Solutions, which manages Quest/VR devices — that’s adjacent infrastructure, not the AI assistant or model-serving stack, and shouldn’t be cited as if it covered them.
AI Act posture
Meta is the one provider among these five that has publicly declined to sign. Meta’s Chief Global Affairs Officer, Joel Kaplan, was reported by TechCrunch and CNBC on 18 July 2025 as stating “Europe is heading down the wrong path on AI” and that “Meta won’t be signing it.” That quote traces to a LinkedIn post this research pass couldn’t fetch directly — worth pulling up the original before publishing it verbatim. See the framework for why the distinction matters from 2 August 2026.
Model inventory notes
Llama’s governance instrument is a license, not a DPA: the version-specific Community License Agreement (covering IP grant, warranty disclaimer, California governing law, and a commercial-license trigger once a licensee exceeds 700 million monthly active users) plus an incorporated Acceptable Use Policy. Enforcement runs through GitHub issue reports, a dedicated report email address, and Meta’s bug bounty program — not a services contract, which is why “coveredByDpa” reads “not applicable” for every Llama model above rather than “Unverified.” Note also that Llama 4’s multimodal capabilities are specifically withheld, by license term, from individuals or companies domiciled in the EU — a restriction with no equivalent among the other providers in this series.
This record describes contractual and governance terms as read on the date shown, for the tier shown. Providers revise terms without notice — verify against the provider's own documentation before relying on any of it. Nothing here is legal advice.