How to object to AI training under the GDPR: Article 21 and each company's form

The Morse teamPublished November 8, 202611 min read

To object to AI training under the GDPR, use the company's own objection form or training setting, state that you object under Article 21 to the use of your personal data to train its AI models, and ask in the same request for that data to be erased. As of November 2026, Meta, LinkedIn, X, Google, and OpenAI each publish a path for people in the EU, and Meta, LinkedIn, Google, and OpenAI say theirs covers the UK too. None of them says an objection takes back what a model has already learned.

This isn't legal advice, and it can't tell you how a regulator would rule on your case. On November 8, 2026, we read Articles 12, 17, 21, and 77 of the GDPR on EUR-Lex, the European Data Protection Board's Opinion 28/2024 on AI models, the EDPB and EDPS joint opinion of February 10, 2026 on the Digital Omnibus, the European Parliament's file on that proposal, and each company's own pages: Meta's newsroom post, its objection forms and help page, LinkedIn's generative AI FAQ and terms update page, X's help page on Grok, Google's Gemini Apps Privacy Hub, and OpenAI's EU privacy policy and training article. We also read the Hamburg data protection authority's guidance on Meta. Hamburg deserves credit. Its page answers the questions Meta's own pages leave open, like whether you need a reason and whether one objection covers linked accounts.

What does Article 21 of the GDPR give you?

A right to make a company stop, unless it can justify carrying on. Article 21(1) lets you object "on grounds relating to his or her particular situation, at any time" to processing based on a public task or on legitimate interests, the bases in points (e) and (f) of Article 6(1). The company "shall no longer process the personal data unless" it "demonstrates compelling legitimate grounds" that override your interests, or needs the data for legal claims.

Three other parts of the article shape how you use it:

• Article 21(4) says the right must be "explicitly brought to the attention" of people "clearly and separately from any other information." Meta says its April 2025 notices to EU users went out in-app and by email.
• Article 21(5) lets you object "by automated means using technical specifications" for online services. A training switch in your settings is a way of objecting.
• Article 21(2) and (3) make an objection to direct marketing absolute. An objection to AI training isn't, so a company can weigh it.

Article 12(3) sets the clock. A company must tell you what it did "without undue delay and in any event within one month of receipt of the request," extendable "by two further months" for complex cases if it tells you why within the first month.

Does AI training use legitimate interest, and why does that matter?

Yes, at most of the large companies, and that's what makes Article 21 apply. The EDPB's Opinion 28/2024, adopted December 17, 2024, says that "whenever legitimate interest is relied upon as a legal basis by a controller, the right to object under Article 21 GDPR applies and should be ensured." LinkedIn's terms page says of European members: "We rely on legitimate interest to process your data for this purpose." Google's Gemini hub lists "Google and third parties' legitimate interests" as the basis for processing "information from publicly accessible sources and your Gemini Apps information" to develop its models.

The opinion also lists safeguards regulators can look for when a company weighs its interests against yours. Two of them are about objecting: "an unconditional 'opt-out' from the outset," offered "before the processing takes place," which "goes beyond the conditions of Article 21 GDPR," and "a reasonable period of time between the collection of a training dataset and its use," so people have time to object. Meta's April 2025 post says the opinion "affirmed that our original approach met our legal obligations" (Meta). The opinion itself leaves each case to national regulators.

How do you object to Meta training AI on your data?

Through the objection form for each app, while signed in. Meta's April 14, 2025 post, last updated March 27, 2026, says EU users got notices with "a link to a form where people can object to their data being used in this way at any time," and that Meta will "honor all objection forms we have already received." The Facebook form says it's "only accessible to people who have an active Facebook profile." Instagram has its own form.

The Hamburg data protection authority fills in the details. Giving a reason is "not required." If your Facebook and Instagram accounts are linked in Accounts Centre, "one objection is sufficient." The objection covers your own posts but not photos of you on other people's accounts. And it is "limited to future AI training," so it doesn't reach data used between May 27, 2025 and the day you objected. Hamburg also says Meta trains on chats with its AI and "There is no option to object to this."

Meta's post sets two limits on what it takes. It doesn't train on private messages "unless you or someone in the chat chooses to share those messages with our AIs," a line it added on March 27, 2026, and public data from EU accounts of people under 18 "is not being used for training purposes."

If you have no Meta account, or your concern is data Meta took from the web or licensed, there's a separate form. Meta says it can't tie that data to anyone, so it offers no way to "access, download, correct or delete" it, and "We don't automatically fulfill requests sent using this form."

Meta's general help page on objections says the right covers "the EU or the UK," and adds a step about erasure. If an objection succeeds, you can ask for erasure under Article 17(1)(c), but "You'll need to make this request when you submit your objection, using the free text field." For the switches outside Europe, see how to turn off Meta AI.

How do you object to LinkedIn training AI on your data?

For your profile, posts, and AI prompts, the setting is the objection: turn off Data for Generative AI Improvement. LinkedIn's terms update page says that since November 3, 2025, it uses data from members in the EU, EEA, Switzerland, and the UK on legitimate interest, and "You can opt out anytime in your settings." For UK members, the same switch also stops LinkedIn sharing that data with Microsoft for its model training. If you sent LinkedIn's objection form before that date, the page asks you to "check your settings value to make sure your choice to opt out is shown."

Three things need the Data Processing Objection form instead, according to LinkedIn's generative AI FAQ: feedback you give LinkedIn, training for models that don't generate content, and "content that includes personal data related to you," which covers posts other members write about you. We walk through the setting step by step in how to opt out of LinkedIn AI training.

How do you stop X and Grok training on your posts?

With one setting. X's help page on Grok gives the path: Settings, Privacy & Safety, Grok & Third-party Collaborators, then clear the box "Allow your public data as well as your interactions, inputs, and results with Grok and xAI to be used for training and fine-tuning." That one box covers both your public posts and your Grok chats. X adds that making your account private keeps your posts from being used to train Grok.

X names two gaps. If you rate a Grok answer after opting out, "X and xAI may use that conversation" for training. And for X features powered by Grok, "the opt-out does not prevent a deployed model from learning as a result of its normal use." X's page describes these as settings and doesn't mention the GDPR, so if you want a formal Article 21 objection on record, send one through its privacy form as well.

Can you object to Google and OpenAI training on your data?

Yes, both name the right on their own pages. Google's Gemini Apps Privacy Hub, updated October 26, 2026, says that under the GDPR you may have the right to "Object to the processing of your personal data," through a request in Google's Help Center or Report legal issue under a Gemini answer. The training switch is Keep Activity in Gemini Apps Activity. Two lines on the same page limit it: "Your Gemini settings don't control processing of your chats to create anonymized data to improve Google services," and chats a human reviewer has seen "are retained for up to three years" even after you delete them.

OpenAI's EU privacy policy, which covers the EEA, the UK, and Switzerland, lists the right to "Object to how we process your Personal Data when our processing is based on legitimate interests," through your account tools, privacy.openai.com, or dsar@openai.com. Its training article gives the switches: Improve the model for everyone under Settings > Data controls, or Do not train on my content in the Privacy Portal. A thumbs up or down after opting out lets OpenAI use "the entire conversation associated with that feedback." We compare more companies' training rules in which AI companies train on your data.

Every published objection path, read on November 8, 2026

Does objecting remove your data from a model already trained?

No company we read says it does, and regulators say it may not be possible. LinkedIn's FAQ says opting out "does not affect training that has already taken place." Meta's page on model training says that if you delete something a model learned from, "the model won't change in that moment," though the information "won't be used for future training." Hamburg's regulator says training data is "irrevocably incorporated" into models, and "its influence cannot be removed from the model."

The EDPB and EDPS said in their joint opinion of February 10, 2026 that the right to object should reach people "sufficiently in advance" of training, because "it might for instance prove technically difficult to remove personal data that is retained in the AI system or model." So object before a company's training date where you can, and pair the objection with an erasure request under Article 17(1)(c), which applies when "the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds." We explain why erasing data from a trained model is hard in what is machine unlearning.

If a company refuses, or doesn't answer within a month, Article 77 lets you complain to the supervisory authority where you live, work, or where the problem happened.

Will the Digital Omnibus change the right to object?

Not yet. The European Commission's Digital Omnibus proposal, published November 19, 2025, would add an Article 88c to the GDPR on legitimate interest for AI, with what the EDPB and EDPS call "an unconditional right to object." Their February 2026 opinion welcomed that right but said it "should be added to Article 21 GDPR" instead, and that "unconditional" needs defining. As of November 8, 2026, the European Parliament's procedure file lists the proposal as "Awaiting committee decision," so Article 21 as written is the right you have today.

Why Morse has no training form to find

Each path above starts from the same place. The company holds your posts or chats first, decides to train on them under a legal basis it chose, and leaves it to you to find a form, object in time, and accept that past training stays put. Morse has no training switch to hunt for. Morse doesn't train AI on your content, sell your data, or show ads (privacy policy), and your chat history is stored in your browser, encrypted, not on our servers.

• Private, for everyday questions you'd rather no company learned from. It's the mode a new chat starts in, on open-weight models like DeepSeek, Kimi, and GLM, plus xAI's Grok. Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing.
• E2EE, for anything no one should read at all. Your browser checks the secure enclave's attestation before anything leaves your device, then encrypts the message so only that enclave can read it, and our servers relay ciphertext they can't read. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed.
• Anonymous, for GPT, Claude, or Gemini without the provider knowing it's you. Our proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider sees the text and may keep it for a limited time to check for abuse, under its own policy, so leave out names and details that identify you.

Unlocking your history takes two keys, one that never leaves your device and one our server gives you at sign-in. Because we don't store chats, we usually have very little to give authorities. Clearing your browser or deleting your account removes your chats for good, and Morse can't recover them.

Try a chat from the Morse home page without an account, or start free with no card. E2EE chats come with Pro, at $19 a month.