Meta’s Muse Image draws scrutiny: privacy group NOYB challenges AI data practices

Meta this week launched Muse Image, an AI image generation model integrated with public Instagram accounts, allowing anyone to tag another user’s handle in a prompt and generate an image based on that account’s likeness — without the account owner being notified, according to Meta’s own policy.

The launch adds to existing scrutiny of how Meta handles user data for AI purposes. The company relies on the General Data Protection Regulation’s ‘legitimate interests’ legal basis to process European users’ data for AI training, using an opt-out rather than opt-in approach — a position that privacy group NOYB has challenged.

Meta says Muse Image is designed to make AI image generation more personal by letting users reference public Instagram accounts. An opt-out setting exists under Profile, then Menu, then Sharing and reuse, where the Posts and Reels toggles under ‘Allow people to reuse your content on Instagram and with AI features at Meta’ can be switched off. The feature is still rolling out, starting in the US.

Opting out only blocks future image generation; it does not remove AI images already created using an account’s likeness before the setting was changed. Switching an account to private is, for now, the most complete way to prevent the feature being used on a profile.

Cybersecurity firm Malwarebytes warned in a blog post that the tool could be used for impersonation, scams or other abuse, pointing out that public Instagram photos were already being used by attackers to create deepfakes for identity verification fraud.

Meta’s AI products have drawn other security concerns this year, including a previously disclosed ‘confused deputy’ flaw in its AI support chatbot that could let it change account emails and reset passwords without properly verifying the user’s identity; multi-factor authentication was found to mitigate the risk.