Show every user the AI training opt-out before training starts, on every device

Your web app has had a switch labelled something like "use my content to improve our AI" since spring. The iOS app got it two releases later, and free users on Android never got a settings screen for it at all. Ireland's Data Protection Commission (DPC), the lead EU regulator for many large technology companies, found that gap in a live AI chatbot in January 2025: non-subscribers on mobile were never offered the opt-out from AI training, which could have affected up to about 7.7 million users in the EEA. The company fixed it by February 2025 and committed not to train on any data collected while the opt-out was missing 1. The lesson: every user has to be told about the opt-out, and the DPC recommends that every user can use it before their data goes into training, whatever app, plan or device they use.

This applies if your product trains or improves its AI on what users type, upload or do, and users can switch that off rather than having to switch it on. In GDPR terms you are most likely relying on "legitimate interests": you did not ask permission, so people get the right to say no. It applies to B2B products too. If you train one shared model on what your customers' users upload, you become a controller for that training. That raises its own questions with each customer, which I cover in the post on training AI on customer data. And if your basis for the training is legitimate interests, their end users need the opt-out in this post as well.

What happens if you train on data from users who never saw the opt-out?

At the upper end, you can be made to stop and to delete what you trained on. The DPC's report has one case like that, more serious than a single missing screen. In July 2024 it found that key safeguards were not in place while X trained its Grok model on users' data. X refused to stop, so the DPC used an urgency procedure in Ireland's High Court, and X gave an undertaking to stop processing the data collected while the safeguards were missing and to delete the datasets that contained it 1.

The European Data Protection Board (EDPB, where the EU's data protection regulators agree common positions) sets out in its 2024 opinion on AI models what a regulator can do when an AI model was trained on unlawfully processed data. It can order erasure of the whole dataset or the model itself, where erasing only the unlawful part is not possible and the order is proportionate. Short of that, it can fine, limit the processing, or order the unlawful part of the dataset erased 3.

The chatbot company did something smaller on its own: it committed to leave the data from the gap out of training. I would treat data from a surface without the opt-out the same way. My reasoning, which neither regulator states in these words: the EDPB lists an unconditional opt-out offered before training as an optional safeguard that goes beyond what the right to object requires 3. If your case for legitimate interests relied on that safeguard, it did not exist for the users who never saw it.

What does the GDPR require before you train on user data?

It requires that every user is told about the right to object, and that using it is easy. If you rely on legitimate interests, each user has that right. You have to tell them about it when you collect their data, "clearly and separately from any other information", and at the latest the first time you communicate with them, and you have to make the right easy to use 2. The users in the chatbot case who were shown nothing did not get that.

The DPC adds the timing. Once a model is trained it can be very difficult to remove someone's data, so an objection that arrives after training may change nothing. Its September 2026 report on supervising about 180 AI products says it is not enough to offer an objection form when training begins: people need notice and a way to object before any training starts, and doing otherwise would likely conflict with the GDPR's fairness and transparency principle. Among its recommendations is to make sure that "all users, regardless of what type of device is used", have received the notice and the ability to opt out before their data is used for training 1.

None of this demands a toggle inside every app. One objection page that every client links to and tells people about can do the job.

As of November 2026, the EU is negotiating changes to how the GDPR treats AI development, starting from the Commission's Digital Omnibus proposal 4. None of it is law yet, so the rules above apply.

Where does an opt-out usually go missing?

In the parts of a product that are released separately from the main web app. The DPC case was a mobile app for non-paying users, and I would look in the same kinds of places:

• Mobile apps that lag the web. The web app gets a new settings toggle the day it merges. The iOS and Android apps get it when the next release passes app store review, and older versions stay installed for months.
• Plans and sign-in states. Free users, trial users, logged-out users and team members invited by an admin often see different settings screens, or none.
• Secondary clients. A desktop app, a browser extension, a Slack or Teams bot, an API. If any of them sends user content into the same training data, its users need the same notice.
• Settings stored per device. If the objection is saved in the app's local settings and never reaches the server, the code that builds training datasets cannot see it, and the user who opted out on a phone is still in the data from the laptop.

A setting saved in one place and ignored in another has already cost one company a fine: the Spanish bank BBVA was fined in Italy after its app saved a customer's marketing opt-out, and the system sending promotions never received it.

How should the opt-out be worded?

The DPC makes two points about wording:

• Say it is unconditional, if it is. The GDPR lets a company refuse an objection if it shows "compelling legitimate grounds" 2, so some companies write "if your objection is honoured". The DPC calls that phrase misleading where the company intends to honour every opt-out, because it discourages people from using it 1.
• Show the status. People who object should be able to see the status of their request, and the notice should say how far the objection reaches and for how long 1.

What should you check before training on user data?

If your product trains on what users type, upload or do, with an opt-out, these are the checks I would run.

1. List every surface that collects the data. Web, each mobile app and its oldest supported version, desktop, extensions, bots, the API, and every plan and sign-in state.
2. Open each one as that user would. Confirm the notice and a way to opt out are there, findable, and shown before the data from that surface is used for training. A link to one central objection page counts. Use a real device and a free account, because your admin login may see screens a free user never does.
3. Store the objection on the server. Tie it to the account, so one choice applies on every client and the code that builds each training dataset reads it when it runs. For logged-out use, where there is no account, keep that data out of training.
4. Record when each surface got the opt-out. If one shipped later than the rest, leave the data it collected before that date out of training.
5. Put the opt-out in the release checklist. In the DPC's words, "compliance does not end with a feature or product's launch" 1. A new client or a new plan is a new surface, and it ships with the notice and the opt-out.
6. Fix the wording. Drop "if your objection is honoured" if you honour every objection, and tell people when their opt-out has taken effect.
7. Keep private messages out. This one is my own advice: the DPC says justifying training on private messages under legitimate interests "will be very difficult to achieve" 1.

Your privacy policy probably describes the training and the opt-out in one paragraph, and every release of every app has to keep that paragraph true. Lawcel, which we build, is a compliance tool that reads each pull request against your legal documents and comments on the ones that change what those documents describe, such as a change that starts sending user data to training. Whether the opt-out exists on your oldest Android version is a test you write yourself.