Meta AIA plumber runs his small business almost entirely through WhatsApp: bookings, addresses, the occasional photo of a problem, invoices. One evening, juggling messages, he taps the little blue circle, Meta AI, and asks it to "write a polite reminder to the customer at 14 Oak Lane who hasn't paid", pasting in her name, address and the amount.
He has used WhatsApp for years, and it has always told him his chats are end-to-end encrypted. That is still true, for his chats with customers. But the moment he tapped the assistant, he stepped outside that encryption. His message to Meta AI is processed on Meta's servers under a consumer privacy policy and used to improve Meta's models, and since late 2025 Meta has also used it to personalise ads. There was no business agreement, no processor relationship and no way to opt out of the data use.
Meta AI did not break into his conversation. It was already there, inside the app he uses for everything, one tap away from a customer's details.
Is Meta AI safe for business data?
No, and the reasons are structural, not a matter of settings. Meta AI is a consumer product. There is no business tier with a data processing agreement, no commitment to keep your inputs out of model training, and since December 2025 no opt-out from using your Meta AI interactions to personalise ads. Whatever you send the assistant is handled on consumer terms.
What sets Meta AI apart from a standalone chatbot is where it lives. It is woven into WhatsApp, Instagram, Messenger and Facebook, and in much of Europe, small businesses run real work through exactly those apps. So the assistant shows up not in a separate "AI tool" people approach carefully, but in the middle of the chat where a customer's address already sits. The blurring of personal and work use is not a user error; it is the design.
How Meta AI handles your data
| Normal WhatsApp chat | Message to Meta AI | |
|---|---|---|
| End-to-end encrypted | Yes | No |
| Readable by Meta | No | Yes (on its servers) |
| Used to improve Meta's AI | No | Yes |
| Used to personalise ads | No | Yes (since Dec 2025) |
| Business data processing agreement | n/a | None |
The single most important distinction: a normal WhatsApp message stays end-to-end encrypted and is not used to train Meta AI. A message to Meta AI is not encrypted, is processed on Meta's servers and falls under the consumer policy. The assistant is off until you involve it, but involving it changes everything about how that content is handled.
On training, Meta uses public Facebook and Instagram posts of adult EU users to improve its models, on a "legitimate interest" basis with an objection form. Private posts, private messages, under-18 content and end-to-end encrypted WhatsApp messages are not used. The line is narrow, so it pays to be precise: public posts and your Meta AI interactions, yes; your encrypted chats, no.
Where the risk sits
1. It lives where work and personal life blur
The defining risk. The assistant is embedded in the apps people use personally and, for many SMEs, professionally. A customer's address is already in the thread; the assistant is one tap away.
2. Sending to the assistant leaves encryption
People trust WhatsApp because it is encrypted. The moment they tag or open Meta AI, that content leaves the encrypted channel for Meta's servers, a shift most users do not register.
3. No opt-out from data use
Since December 2025, Meta AI interactions have been used to personalise ads, with no opt-out. The only way to avoid it is not to use the assistant. For a consumer that is a choice; for work data it is a problem.
4. Accidental publishing
The June 2025 Discover feed showed real users making sensitive conversations public without realising it. Even with the later warning, a feature designed around sharing AI chats is a poor fit for anything confidential. Grok had a similar problem in August 2025, when Google indexed more than 370,000 shared Grok chats.
5. No business protections at all
No data processing agreement, no defined retention, no admin controls, no business tier. Unlike enterprise assistants, Meta AI has no version an organisation can manage.
Each of these flows from one fact: Meta AI is a consumer assistant placed inside the most personal apps people own.
What it means when this goes wrong
Under the GDPR, putting a customer's or employee's identifiable data into Meta AI is processing through a controller that uses the data for its own purposes (model improvement and ad targeting), with no processor agreement and no defined retention. For regulated data, there is no lawful basis on the business's side to do this. If sensitive data is involved, that is a reportable exposure, not a grey area.
Fines reach €20 million or 4% of global annual turnover, whichever is higher, and the liability rests with the organisation as controller. Then there is accidental publishing, which has already happened and is not just a theoretical risk: a sensitive chat that ends up on a public feed is a breach that cannot be recalled. The very accessibility that makes Meta AI convenient is what makes its failures personal and public.
The incidents Meta AI already has behind it
April to May 2025: EU training resumes on an objection-only basis
After pausing in 2024 under pressure from the Irish regulator and noyb, Meta resumed training its AI on EU public Facebook and Instagram posts, beginning in late May 2025, on a "legitimate interest" basis with an opt-out objection form rather than consent. noyb sent a cease-and-desist and threatened collective action. Source: Irish DPC / noyb / TechCrunch, 2025.
June 2025: The Meta AI Discover feed
The standalone Meta AI app's public Discover feed exposed users' conversations, including medical, legal and personal queries, because people did not realise sharing meant publishing. After the backlash, Meta added a warning screen before posting. A separate bug that could have exposed other users' prompts was fixed after a $10,000 bug-bounty report. Source: TechCrunch / Malwarebytes, June-July 2025.
December 2025: Ad personalisation from AI interactions, no opt-out
A change to Meta's privacy policy took effect under which voice and text interactions with Meta AI are used to personalise ads and content across Facebook and Instagram, with no opt-out; the only way to avoid it is not to use Meta AI. Source: Fortune, October-December 2025.
What you can turn off in Meta AI
1. Never send sensitive data to the assistant Normal WhatsApp chats stay encrypted; the risk begins when you open or tag Meta AI. For anything confidential, leave the assistant out of it.
2. Object to training on your public posts In Facebook and Instagram settings, use the Privacy Centre objection form to stop your public posts being used to train Meta's AI, ideally before training starts, since data cannot easily be removed from a model once it has been trained.
3. Use Advanced Chat Privacy and keep AI summaries off Advanced Chat Privacy, set per chat, turns off certain Meta AI features in that chat and blocks exporting it. Keep AI message summaries off as well.
4. Keep client work off personal social apps where you can For business communication that carries personal data, prefer a tool with a data processing agreement over WhatsApp or Instagram DMs, and never route regulated data through Meta AI.
Checked against Meta's documentation as of early 2026; Meta AI's controls and policies change often.
Where the switches end
You cannot remove Meta AI from WhatsApp, and you cannot opt out of how your interactions with it are used. Settings let you object to training on public posts and limit some features, but they cannot change the fact that the assistant sits inside your most-used apps, or decide what a person types when they tap it.
No control takes back a customer's address once it has gone to Meta AI. No toggle retrieves a chat that was published to a feed. The two risks that define Meta AI, an assistant embedded where work and personal life mix and a person who brings sensitive content to it, are beyond the reach of any settings screen.
That is the gap between where Meta AI lives and what a person is about to hand it.
Before the message enters the chat
BeeSensible checks browser text fields for personal data as you type, including web-based chats with Meta AI. The text is sent to BeeSensible's EU detection service, where it is analysed in memory and discarded after detection. None of it is stored. When sensitive content appears, BeeSensible highlights it in the text, so the user sees exactly what they are about to share and can mask it with a placeholder or remove it before sending.
