Meta AI —
The Trojan Chatbot

Built In, Not Invited

Meta AI is Meta Platforms' AI assistant. It is embedded in WhatsApp (over 2 billion users), Facebook, Instagram and Messenger — and comes as hardware in the Ray-Ban Smart GlassesRay-Ban Meta Smart GlassesSmart glasses developed by Meta and eyewear manufacturer Luxottica (Ray-Ban). Contains a built-in camera, microphones and the AI assistant "Hey Meta". Price: approx. $400. Over 7 million pairs sold in 2025.. In the US it has been available since 2023. In Germany, Meta AI rolled out in March 2025, after months of negotiations with European data protection authorities.^[1][2]

Worldwide, Meta AI already has over 700 million users — making it one of the most widely deployed AI assistants in the world. This is not because 700 million people actively installed it. It was already there when they opened their phones.

It Cannot Be Disabled

The integration into WhatsApp is mandatory. There is no setting to fully deactivate Meta AI. Tests by Computing.co.uk confirmed: no menu item, no option, no way to switch the feature off. Anyone opening WhatsApp sees a blue circle button above the "New chat" button. When searching for contacts, AI-generated suggestions appear automatically.^[4]

Your Questions. Meta's Ad Data. ↑ top

On 1 October 2025, Meta announced a change to its privacy policy. From 16 December 2025, the following applies worldwide — except in the EU, UK and South Korea:

In Meta's official privacy policy (as of 16 December 2025), under the collected information categories, it states explicitly: "Interactions with AI at Meta and related metadata. For example, information you or others exchange with AI at Meta like content and messages."^[5]

What Is True — and What Isn't

In November 2025, a viral post spread on Instagram claiming that from 16 December Meta would read "all private messages" — including encryptedEnd-to-end encryptionA method whereby messages can only be read by the sender and recipient — not by the provider. WhatsApp uses the Signal protocol. Protects message content, but not metadata such as "who writes to whom, when". WhatsApp direct messages. This is false.

The EU Situation: Training on Public Posts

In the EU a different but equally significant rule applies. Meta wanted to use public Facebook and Instagram posts from European users to train its AI models. The timeline:

noybnoyb (None of Your Business)European data protection NGO founded by activist Max Schrems. Specialises in strategic GDPR cases against tech companies. Known for cases against Meta, Google and others. Funded by membership fees. (None of Your Business) under Max Schrems sharply criticised this: "Instead of asking users for consent, Meta simply vacuums up all user data and calls it 'legitimate interest'." Despite the DPC authorisation, noyb continued to explore legal action. The Hamburg Commissioner for Data Protection and Freedom of Information also opened its own emergency proceedings.^[13][16]

How Meta Reserved WhatsApp for Itself ↑ top

In October 2025, Meta quietly changed the terms of the WhatsApp Business APIWhatsApp Business APIProgramming interface that allows companies and developers to integrate WhatsApp into their own services. Used by, for example, customer service bots, notifications and — until the rule change — competitors such as Microsoft Copilot.: AI providers may no longer use WhatsApp as their main channel if AI is their core service.

The concrete consequence: Microsoft Copilot left WhatsApp on 15 January 2026. OpenAI's ChatGPT was in the same position. Meta AI, however, may operate freely within the same channel.

The EU Commission considered this a possible violation of competition law. WhatsApp represented "an important access point to consumers" for AI assistants. In December 2025, the EU Commission opened formal competition proceedings against Meta. In January 2026, the EU Commission officially designated WhatsApp as a "Very Large Online Platform" (VLOPVery Large Online Platform (VLOP)Category under the EU Digital Services Act (DSA) for platforms with over 45 million EU users. Subject to stricter obligations: risk assessments, transparency reports, researcher access, prohibition of certain targeting practices.) under the Digital Services ActDigital Services Act (DSA)EU law, fully in force since 2024. Regulates obligations of online platforms: combating illegal content, algorithmic transparency, protection of minors. Complements the Digital Markets Act (DMA). — with significantly stricter requirements.^[17][19]

A Window Into Private Homes ↑ top

The Ray-Ban Meta Smart Glasses look like ordinary sunglasses. They contain a built-in camera, microphones and the AI assistant "Hey Meta". Over 7 million pairs were sold in 2025 — three times more than in 2023 and 2024 combined. Price: around $400.^[30]

The Harvard Experiment: 90 Seconds to Identity

In October 2024, two Harvard students (AnhPhu Nguyen and Caine Ardayfio) demonstrated what the glasses make possible. They combined them with the facial recognition search engine PimEyesPimEyesCommercial reverse image search engine for faces. Searches public websites for photos resembling an uploaded face. Highly controversial under data protection law in the EU — already banned in some countries. and public databases.

Meta's response: the glasses have a small white LED light that illuminates when the camera is running. The students showed: a piece of tape is enough to block it. They did not publish the code — but provided a guide on how to remove one's own face from the affected databases.

The Nairobi Scandal — What Contractors Really Saw

On 27 February 2026, Swedish newspapers Svenska Dagbladet and Göteborgs-Posten published the results of a joint investigative inquiry.

ContractorsAI data annotationProcess in which human workers label, evaluate or review AI training data. Often outsourced to subcontractors in low-wage countries. Known cases: Kenya (Meta/Sama), Kenya (OpenAI/Sama), Ethiopia. of the company Sama in Nairobi, Kenya — a subcontractor of Meta — regularly review video recordings from Meta Ray-Ban glasses in order to train the AI. Among these recordings were:

• Videos of people undressing or using the toilet
• Videos of people engaged in sexual intercourse
• Recordings of bank card information and account details
• Recordings of private conversations

A concrete example from the investigation: a man places the glasses on his bedside table and leaves the room. Shortly afterwards his wife enters and undresses — unaware that the glasses are still recording and transmitting.

Meta's response after two months of not responding to interview requests: contractors sometimes reviewed content to improve the user experience — "as other companies do". Meta takes "the protection of data very seriously". According to the reporters and Sama employees, the facial blurring system "did not work consistently" — particularly in poor lighting conditions.^[25]

Legal Consequences

UK Information Commissioner's Office (ICO)ICO (UK)British data protection authority. Responsible for enforcing the UK GDPR (the British post-Brexit version of the GDPR). Can impose fines of up to £17.5m or 4% of worldwide annual turnover. wrote formally to Meta, demanding explanations of how the company fulfils its data protection obligations.

US class action: Plaintiffs from New Jersey and California, represented by Clarkson Law Firm, sued Meta and Luxottica. Allegations: violation of privacy laws and misleading advertising — Meta had marketed the glasses with slogans such as "designed for privacy, controlled by you" and "built for your privacy".^[28]

EPIC (Electronic Privacy Information Center)EPICUS non-profit data protection organisation founded in 1994 in Washington D.C. Files complaints with authorities, publishes reports and lobbies for privacy legislation. had already in February 2026 asked the California Privacy Protection AgencyCPPAThe first independent state data protection authority in the US, established in 2020 through Proposition 24. Responsible for enforcing the California Privacy Rights Act (CPRA). A model for other US states. to investigate Meta for violation of biometric privacy laws.

Facial Recognition for the Glasses — and the Planned Timing ↑ top

According to a New York Times report from 13 February 2026, based on internal Meta documents, Meta plans to equip the Ray-Ban glasses with a facial recognitionFacial recognitionBiometric method that identifies people by their facial features. Considered particularly sensitive data under GDPR Art. 9. Largely prohibited in public spaces in the EU — exceptions apply to law enforcement. feature called "Name Tag" — possibly as early as 2026.

How it works: the glasses wearer sees a person and asks the AI assistant for information. "Name Tag" is intended to identify the person — either as someone the user knows through Meta platforms, or as someone with a public Instagram or Facebook account.

Meta has, according to the NYT, internally acknowledged the "safety and privacy risks". The feature was initially planned for a conference for visually impaired people as a test environment — to introduce it as an accessibility featureAccessibilityTechnical features that enable people with disabilities to use products. Enjoy high social standing. In the context of Name Tag: Meta planned to test facial recognition initially for visually impaired people — a more PR-friendly introduction context.. This plan was not implemented.^[31]

The Internal Memo: When Best to Go Unnoticed

An internal Meta document from May 2025, seen by the NYT, contains a striking passage about the planned timing for introducing "Name Tag". The company intended to launch the feature in a:

Translated: Meta wanted to launch facial recognition at a time when privacy organisations were distracted by other crises.

The Electronic Frontier Foundation (EFF)EFFUS civil liberties organisation for digital freedoms. Campaigning since 1990 for privacy, free speech and innovation. Known for legal challenges to surveillance laws and technical analyses of privacy risks. commented: "Meta's conclusion that it can escape scrutiny [...] is cowardly and morally bankrupt."

Why This Affects Everyone — Not Just Glasses Wearers

"Name Tag" would not only affect the privacy of glasses wearers. Every person seen by someone wearing Meta glasses could be captured — without ever having consented to data processing.

Three Patterns — and What Lies Behind Them

Meta typically communicates on these issues in three patterns:

"As other companies do" — On the Nairobi scandal, Meta points out that Amazon, Apple and Google also use contractors for data annotation. This is true. What Meta does not say: a camera in glasses worn in living rooms and bedrooms creates a fundamentally different quality of privacy risk than reviewing voice commands to a stationary speaker.

"It's in our privacy policy" — Meta cites its policy as sufficient information. The fact: according to Help Net Security, sales staff in glasses shops in Sweden did not know what the glasses transmit or where data goes. Customers receive contradictory or incomplete information.^[26]

"We filter sensitive data" — Meta claims faces are automatically blurred. According to the Swedish newspapers and statements from Kenyan employees, this system "did not work consistently" — particularly in poor lighting conditions.^[27]

The Price Isn't Money ↑ top

Meta AI is not free. The price is your conversations, your searches, your interests — and if you wear the glasses, possibly the most intimate moments of your life.

What Meta has built is an AI infrastructure embedded directly in the communication channels people use every day. Anyone using these channels is automatically part of the data system. And anyone who believes they don't use Meta AI — because they have never actively chatted with it — still sees the blue circle when they open WhatsApp.