Object to an AI company using your personal data

The short version

• You can usually object to an AI company using your personal data, for example to train its AI on posts you've written online.
• The company has to stop unless it can show a compelling reason that outweighs your rights.
• If you agreed to the company using your data, you can withdraw your consent instead.
• Start with the company's privacy settings or privacy request form.
• If the company says no or doesn't reply, complain to it first, then to the Information Commission.

What the law says

This guide covers your rights if you live in the UK.

You have the right to object if the company says it uses your data because it's in its interests, or someone else's, to do so. Its privacy notice should call this 'legitimate interests'. For information an AI company collects from websites, the Information Commission says this is realistically the only legal basis it can try to use.

Once you object, the company must stop using your data. It can only carry on if it can show a compelling reason that outweighs your interests and rights, or it needs the data for a legal claim. You can't object if the company needs your data for a contract with you or to meet a legal duty.

If you agreed to the company using your data, you have the right to withdraw your consent at any time. It must be as easy to withdraw as it was to agree.

You can also ask the company to delete your data if you've withdrawn your consent or objected, unless it has another legal reason to keep it. The Information Commission says it can be hard to remove your data from an AI that's already been trained without training it again.

Companies that build AI chatbots must tell you what personal data they use to train their AI and how to use your rights, the Information Commission says.

The company has 1 month to respond to your request. It can take up to 2 more months for a complex request, but it must tell you why within the first month. Making the request is usually free. If the company refuses, it must tell you why and that you can complain to the company or the Information Commission.

If you use the company's chatbot

Check the privacy or data settings in your account for an option to stop your chats being used to train the AI. The Information Commission expects AI companies to tell users about any options to opt out.

If you don't use the company's services

Look in the company's privacy notice for a form or email address for privacy requests. An AI company might have used posts you've written on websites, even if you don't use its services. The Information Commission expects AI companies to make it easy for people who aren't their users to find and use their rights.

Our guide explains how to find out what data a company holds about you.

What you can do

1. Use the company's opt-out setting or privacy request form, or write to the company. Say which use of your data you object to, for example training its AI on your chats, and why, based on your own situation.
2. Ask the company to delete your data too, if you want.
3. Keep a copy of your request and the date you sent it.

If the company refuses, or doesn't reply within 1 month and hasn't told you it needs longer, make a complaint to the company. It must acknowledge your complaint within 30 days and tell you the outcome.

If you're still not happy, complain to the Information Commission. You'll need a copy of your complaint to the company.

Contact the Citizens Advice consumer service if you're not sure what to do next. In Scotland, get consumer help from Advice Direct Scotland. In Northern Ireland, contact Consumerline.