LinkedIn Case: Data use for AI training paused following regulatory engagement

1. The facts

   As reported by news outlets in September 2024, LinkedIn, a Microsoft group company, updated its privacy policy to allow the reuse of user posts and content for training generative AI models. The chosen operational method relied on default activation, placing the burden on the user to exercise an opt-out procedure to prevent data use. The case is currently subject to an administrative inquiry by European supervisory authorities.\n\nThe intervention by the Irish Data Protection Commission (DPC), in coordination with the Italian Privacy Authority, highlighted critical issues regarding transparency and the inadequacy of the chosen legal basis. Following regulatory scrutiny, the company agreed to temporarily suspend processing for users in the European Economic Area. This suspension does not concern third-party web scraping, covered in other articles of this column, but rather internal processing for developing proprietary technologies based on a claimed corporate legitimate interest supposedly prevailing over data subjects' rights.

2. 

   The rules at play

   The legal core of the dispute lies in Article 6(1)(f) of the GDPR, which governs legitimate interest as a legal basis. This provision allows data processing without the data subject's consent only when strictly necessary for the legitimate interests pursued by the controller or a third party, provided that such interests are not overridden by the fundamental rights and freedoms of the data subject. Invoking this legal basis requires conducting a rigorous balancing test which, in the context of training AI systems, presents substantial compliance challenges.\n\nAdditionally, Article 21, establishing the right to object, and Article 25 of the GDPR, concerning Privacy by Design and Privacy by Default, are central. Automatically enabling high-risk data processing without a prior affirmative action potentially conflicts with these principles. Finally, the purpose limitation principle under Article 5(1)(b) of the GDPR is implicated: can personal data provided for professional networking purposes be lawfully reused to train algorithmic models without obtaining new, explicit consent?

3. Jurisprudence

   European Court of Justice case law has established that social network operators cannot indiscriminately invoke legitimate interest to justify massive processing activities aimed at profiling or personalized services. The CJEU has emphasized that the balancing test must strictly account for the data subject's reasonable expectations based on their relationship with the controller: an individual publishing content on a professional network does not reasonably expect those data to be used as training material for generative AI systems.\n\nFurthermore, guidelines from the European Data Protection Board (EDPB) indicate that for highly complex and substantially irreversible processing operations, such as the technical inability to extract individual data points ex post from a trained model, legitimate interest is an insufficient legal basis. In such cases, established principles require explicit consent (an opt-in model), enabling the user to make an informed choice regarding the destination of their personal data.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. Lessons for professionals

   1. Legitimate interest cannot be used to bypass consent requirements in high-impact AI projects.
   2. The Legitimate Interest Assessment (LIA) documentation must be analytical and readily available for production to supervisory authorities.
   3. Privacy by Default is a binding legal obligation requiring an opt-in mechanism for invasive processing activities.
   4. Prior to ingesting data into AI training datasets, controllers must evaluate processing reversibility to mitigate the risk of forced model deletion under regulatory sanctions.

References: Articoli 5, 6, 21 e 25 del Regolamento UE 2016/679 (GDPR) [GDPR]Articoli 5, 6, 21 e 25 del Regolamento UE 2016/679 (GDPR)

Editorial oversight: Avv. Federico Papa·ICAMUpdated 24 September 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction