Can AI companies train on my posts and photos?

The battle line of the decade. What’s happening: social platforms and AI firms train models on “public” content — posts, photos, captions — citing legitimate interest (Art. 6(1)(f)) rather than asking consent. Meta rolled this out for EU users in 2025 after friction with regulators; others scrape the open web wholesale. Is it lawful? Genuinely contested. The EDPB’s Opinion 28/2024 on AI models doesn’t bless blanket training: legitimate interest requires necessity, a balancing against your rights, and real transparency — and models that memorise personal data create their own GDPR problems. Privacy groups (noyb foremost) have complaints running; scraping faces for recognition databases is already banned outright (AI Act Art. 5, Clearview fines). What you can do today: (1) Object — platforms training on user content must offer an Art. 21 objection route; Meta’s is a form in settings/help (“object to your information being used for AI”). File it; they have honoured objections filed at any time. (2) Lock down — private accounts are generally excluded from “public content” training sets. (3) Ask — Art. 15 covers whether your data fed training, in theory; expect vague answers and cite the EDPB opinion back. (4) Complain — to your DPA; volume builds cases. Chat content you type into an AI is a separate risk: assume prompts may be reviewed and don’t paste others’ personal data into them — that processing is on you. Rules are moving fast; follow the fights on What’s changing.