Meta removed a feature from its new Muse Image tool on July 10, 2026, three days after launch, after users objected to a setting that let anyone generate AI images using photos from public Instagram accounts without those account owners taking any action. The reversal lands alongside a Surfshark study, published May 12, 2026, that found 8 of the 10 most popular social media platforms set AI training consent to on by default, requiring users to actively find and disable the option rather than opt in.

Your Feed Has a Viewability Problem

If nobody's reading it, did it ever really load? Add PPC Land as your preferred source in Google Search and actually see the stories that matter.

Fix My Sources

A three-day feature

Meta introduced Muse Image on July 7, 2026, describing it in a company blog post as the first image generation model built by Meta Superintelligence Labs. The tool let people type conversational prompts to create or edit pictures inside the Meta AI app, and it rolled out simultaneously to Instagram Stories and WhatsApp. Among its launch capabilities was an option to @-mention any public Instagram account and pull that account's photos into a newly generated image, whether or not the account's owner had requested or approved the reference.

Three days later, on July 10, Meta appended an update to the same announcement. The company wrote that the intent had been to give people a useful creative tool while letting them control whether their public content could be referenced this way. It then stated plainly that the feature had "missed the mark" and confirmed it was "no longer available." Meta did not specify how many images had been generated using the feature during its brief availability window, nor did it disclose how many Instagram accounts had been referenced without the account holder's direct involvement.

Surfshark, a cybersecurity company, connected the reversal to its own earlier research on the same day Meta made its correction. Luís Costa, Research and Insights Team Lead at Surfshark, described the @-mention feature as a departure from how AI systems had previously been trained. "While past AI developments mostly worked out of sight, Muse Image changes the game by letting users directly reference public Instagram accounts to create images using data from those posts," Costa said. "This shift turns the 'consent on' default into a critical privacy risk, as individuals have no way of knowing when their personal photos are being harvested as source material for someone else's AI-generated content."

Costa's comments describe the @-mention feature in the present tense, as an active and ongoing mechanism. By the time those comments were made public, however, Meta had already begun withdrawing the feature: the company's 15:45 Pacific Time update on July 10 confirmed the tool was no longer available. Both descriptions are accurate for the period they cover. The feature functioned as Costa described for the three days it was live, and Meta removed it the same day. The sequencing matters because it shows how quickly a default-on setting can move from launch to reversal once it draws public attention, not because either account of the facts is in dispute.

What the underlying study found

Separate from the Muse Image episode, Surfshark's research team had published a broader study on May 12, 2026, titled "AI training on social media: can you really say no?" That study examined opt-out procedures across the ten most popular social media platforms, ranked using Cloudflare's web traffic and engagement data, and asked a narrower, more structural question: when a platform trains its AI systems on user-generated content, how difficult is it for an ordinary user to say no?

The researchers downloaded the mobile application for each platform, with the exception of Kwai, which was unavailable in the region where the study was conducted. For each accessible app, the team recorded the default setting for AI training consent, then attempted to opt out and counted the number of discrete actions required to do so. An action was defined narrowly: a click, a piece of entered personal information, or a toggle. For Discord, Reddit, and Kwai, where opt-out options were not readily identifiable inside the apps themselves, the team instead reviewed each company's published privacy policy to determine its stated position.

The headline finding was that 8 of the 10 platforms examined set AI training consent to on by default. Facebook, Instagram, TikTok, LinkedIn, X, Snapchat, Pinterest, and Reddit all fell into this category, meaning that unless a user actively navigates account settings to object, their public posts, photos, and interactions become eligible for use in training generative AI systems. Kwai was excluded from this default-setting count because the study found no transparent disclosure of its practices, and Discord stood alone as the single platform among the ten that stated outright it does not use user data to train AI models.

The mechanics of opting out, platform by platform

The study's most granular finding concerned not whether a platform trains on user data, but how hard it is to stop. TikTok required the most effort of any platform examined: 19 separate actions to submit a request objecting to AI training, according to the study's tabulation. That process, as detailed in supplementary data reviewed for this article, routes a user through a sequence beginning with a profile click, then into a hamburger menu, then settings and privacy, then a privacy centre, then a multi-step data rights form that requires selecting a country, confirming an account username, choosing a specific legal basis for objection under data protection law, and finally submitting a written justification before the request is accepted.

Facebook and Instagram required fewer steps for publicly posted content, at 8 actions each, though the study noted this process still lacks the clarity of a single toggle switch and instead directs users through a privacy centre and object-to-processing flow. Both platforms' opt-out mechanisms trace back to Meta's own generative AI privacy notice, which the company has maintained since at least April 2025, when Meta first documented that it would train models on public Facebook and Instagram posts while offering an objection process for users who wished to decline. That framework distinguishes between content Meta considers always public, such as usernames, profile pictures, and Marketplace reviews, and content a user actively chooses to make public, with the broader category subject to potential AI training use unless the user separately objects.

Snapchat, LinkedIn, X, and Pinterest sat in the middle of the study's difficulty ranking, each requiring between three and five actions inside a mobile app to locate and disable a training-consent toggle. LinkedIn's version, according to the study's underlying data, requires a user to open their profile, navigate to settings, select data privacy, locate a submenu labeled data for generative AI improvement, and toggle off a setting titled "use my data for training content creation AI models." X's equivalent path runs through a section the platform labels Grok and Third-Party Collaborators, where a toggle governs whether public posts, along with a user's own interactions with Grok, may be used for training and fine-tuning. In each of these cases, the default remains consent-on: a user who never visits the relevant menu has, by default, made their public data available for training.

Reddit presented a different case entirely. The study found no mechanism, anywhere in the platform's interface or published policy, allowing a user to opt out of having their posts and comments used for AI model development. Reddit's position traces back to a series of licensing agreements the company struck with AI developers starting in 2024. Reddit and Google first expanded their data partnership in February 2024, granting Google access to Reddit's Data API for what the companies described as improved search integration and AI training use. Three months later, Reddit struck a parallel agreement with OpenAI, licensing its data API to support training and fine-tuning of OpenAI's models. Neither company disclosed the financial terms of its respective deal at the time, though the Surfshark study cites a widely reported figure suggesting the Google arrangement alone was worth approximately 203 million dollars annually. Reddit permits selected partners to license its content under these formal agreements while providing individual users no corresponding path to withdraw their own contributions from that same pool.

Regulatory context predates the study

The tension the study documents, meaning platforms defaulting users into AI training rather than asking first, has already produced regulatory friction in Europe well before either the May study or the July Muse Image episode. A German court ruling, upheld through 2025, found that Meta's use of public profile data for AI training could proceed under a legitimate-interest legal basis, but only after Meta agreed to specific concessions: reducing the number of steps required to object to processing from eight clicks down to three, simplifying its objection forms, and pledging to exclude data belonging to individuals under 18 from its training datasets going forward.

More recently, a comparative academic analysis covered by PPC Land in March 2026 mapped how data protection authorities across multiple jurisdictions have approached the legal basis question for AI training, and it found a striking pattern: regulators converge on general principles while diverging sharply in enforcement. The paper, published in International Data Privacy Law and authored by researchers from Zhejiang University, Ghent University, Shandong University, and Queen Mary University of London, documented that France's CNIL has explicitly found that mass web scraping for AI training typically fails a reasonable-expectation test under European data protection law, even as other national regulators have taken a comparatively softer approach toward the same underlying practice. Brazilian regulators, according to the same analysis, went further still, requiring platforms operating in that market to adapt their data protection impact assessments explicitly to Brazilian law rather than simply importing frameworks built for the European Union.

Consumer sentiment data gathered independently of the Surfshark study points in a broadly similar direction. Usercentrics, a Munich-based consent management company, surveyed 11,000 consumers across seven markets in March 2026 and found that roughly one in four had already canceled a subscription, switched providers, or reduced spending specifically because of concerns about how a company used their data for AI purposes; that research was covered by PPC Land on June 27, 2026. The same survey found that 52 percent of respondents said they would pay a premium, on average around 7 percent, for products from companies they trusted to handle their data responsibly. Whether that stated willingness to pay translates into measurable brand preference is a separate question the survey does not resolve, but the underlying discomfort with default-on AI training settings, documented independently by Usercentrics in March and by Surfshark in May, appears consistent across both datasets.

Not Meta's first default-setting controversy this year

The Muse Image reversal is not an isolated event within Meta's recent product history. In late June 2026, during Cannes Lions week, the outdoor retailer REI discovered that Meta had automatically enrolled its advertising account into a separate AI image-generation tool without REI's knowledge, a decision that PPC Land covered in detail on June 26, 2026. The tool subsequently altered a vendor-supplied bicycle photograph used in an Instagram advertisement, producing a visibly deformed image that ran for approximately a week before REI's marketing team noticed and removed it. REI later confirmed to reporters that it had not knowingly opted into the feature and that the enrollment setting had been enabled by default inside its Meta Ads Manager account.

Both episodes, the REI enrollment and the Muse Image Instagram tagging feature, share a structural pattern: a Meta AI product ships with an expansive default setting, and only sustained public objection prompts the company to narrow or withdraw it. Whether that pattern reflects deliberate product strategy or a series of independent judgment calls made under competitive pressure to ship generative AI features quickly is a question Meta has not addressed directly in either case.

TikTok's regulatory history adds weight to its opt-out ranking

TikTok's 19-step opt-out process, the most burdensome documented in the Surfshark study, sits against a backdrop of the platform's broader regulatory history in Europe. Ireland's Data Protection Commission fined TikTok 530 million euros on May 2, 2025, a decision that centered on unlawful transfers of European user data to servers located in China rather than on AI training practices specifically. Separately, an analysis published in May 2025 examining TikTok's terms of service in detail documented the extensive scope of data the platform collects, coinciding with formal European Commission proceedings against TikTok that had opened in February 2024 covering algorithmic risk assessment, minor protections, and advertising transparency. None of that history directly explains why TikTok's AI-training opt-out specifically requires 19 actions rather than fewer, but it does situate the finding within a company whose data practices have already drawn sustained regulatory attention on multiple fronts.

What the study does not establish

The Surfshark research is presented by its authors as a study of stated platform policies and observed opt-out mechanics, not as a measurement of how much user content has actually been ingested into any specific AI model, nor as a legal determination that any of the ten platforms violated applicable data protection law. The study's own methodology section acknowledges that opt-out compliance obligations vary by jurisdiction: platforms are not necessarily required to honor an opt-out request submitted by a user whose country lacks relevant data protection legislation, meaning the practical value of even a working opt-out toggle differs sharply depending on where a user is located. The study identifies users in the European Union, the European Economic Area, and the United Kingdom as benefiting from the strongest legal protection under the General Data Protection Regulation, while noting that users in the United States and many other jurisdictions currently lack an equivalent legal backstop.

The study also does not quantify a monetary value for any platform's AI training data, nor does it estimate how much revenue any of the ten companies derives from AI licensing or training activity. Reddit's disclosed licensing arrangements with Google and OpenAI are the only such data monetization figures referenced in the underlying research, and even those rest on previously reported estimates rather than confirmed disclosures from either company.

Timeline

  • February 22, 2024: Google and Reddit announce an expanded data partnership covering AI integration and search accessibility.
  • May 17, 2024: Reddit and OpenAI announce a data licensing partnership for AI training and feature development.
  • April 20, 2025: Meta documents its policy for training AI models on public Facebook and Instagram content, including an opt-out mechanism.
  • May 2, 2025: Ireland's Data Protection Commission fines TikTok 530 million euros over data transfers to China.
  • March 2026: Usercentrics fields its State of Digital Trust 2026 survey of 11,000 consumers across seven markets.
  • May 12, 2026: Surfshark publishes "AI training on social media: can you really say no?", finding 8 of 10 platforms studied set AI training consent to on by default.
  • June 26, 2026: Meta's automatic enrollment of REI into a separate AI image tool becomes public, following an incident during Cannes Lions week.
  • July 7, 2026: Meta launches Muse Image, including a feature letting users @-mention public Instagram accounts to reference those accounts' photos in AI-generated images.
  • July 10, 2026: Surfshark publicly connects the Muse Image reversal to its earlier May study on AI training defaults.
  • July 10, 2026, 15:45 Pacific Time: Meta updates its Muse Image announcement, confirming the Instagram @-mention feature is "no longer available."

Summary

Who: Meta, Surfshark, and the ten social media platforms examined in Surfshark's research, including Facebook, Instagram, TikTok, Snapchat, LinkedIn, X, Pinterest, Reddit, Kwai, and Discord.

What: Meta launched an AI image tool called Muse Image with a feature letting users generate images by referencing public Instagram accounts, then withdrew that specific feature three days later following user objections. Separately, a Surfshark study published in May 2026 found that 8 of these 10 platforms set AI training consent to on by default, with opt-out processes ranging from a nonexistent option on Reddit to a 19-step process on TikTok.

When: Muse Image launched July 7, 2026; Meta removed the Instagram tagging feature on July 10, 2026, at 3:45 p.m. Pacific Time. The underlying Surfshark study was published May 12, 2026.

Where: The events described span Meta's global product rollout through the Meta AI app, Instagram, and WhatsApp, with regulatory context drawn primarily from the European Union, where GDPR provides the strongest protections identified in the study.

Why: The episode illustrates a recurring pattern in how major platforms structure AI training consent, defaulting users into data collection and requiring active steps to decline, at a moment when regulators in multiple jurisdictions are actively contesting what legal basis, if any, justifies that default.