AI Training with Personal Data on Social Media: Regulatory Response in Brazil and in the European Union

The widespread use of personal data found in social media platforms for artificial intelligence (AI) training purposes raises significant legal concerns, particularly regarding data protection and privacy. This paper critically examines the legal boundaries and possibilities involved in the use of personal data extracted from social media platforms for AI training, with a focus on the Brazilian General Data Protection Law (LGPD) and the General Data Protection Regulation (GDPR). It investigates the legal foundations for processing such data through the analysis of concrete cases and the challenges arising from them, including the need to justify further processing of personal data, as well as the lawfulness of legal bases arising from this context. To this end, current industry practices, decisions from data protection authorities, and regulatory initiatives are examined, considering the approval and enforcement of the EU AI Act. As a result, the investigation unfolds that the current baseline for personal data protection presents significant gaps in light of the complexity of the digital context emerging around increasing adoption of AI. Therefore, it is proposed that legal guidelines must be established within robust AI governance, in line with technical solutions, to ensure that personal data processing for the purpose of generative AI training is compatible with data protection and privacy.