Back to all lessons
Awareness Lessons
last month

Meta's Muse AI Secretly Profiles Your Social Circles

Written by AI from the linked story. Not reviewed by an editor. How this works

Meta's Muse AI application was found to silently compile detailed profiles of users' friends and family members — people who never consented to having their data collected or analyzed. Researchers discovered this by extracting internal application files, revealing that the AI aggregates relationship facts, personal history, and behavioral suggestions without transparent disclosure to end users. This matters because third parties (friends and family) have no knowledge their information is being harvested, removing any possibility of informed consent. The depth of relational data collected creates serious risks including potential misuse, data breaches, and manipulation, and likely conflicts with privacy regulations such as GDPR and CCPA.

Tactical Insight

Immediate actions

  • Review and audit the permissions and data access scopes granted to any AI-powered applications installed on personal or corporate devices.
  • Uninstall or restrict AI social applications that cannot provide transparent, auditable data collection disclosures.

User awareness measures

  • Educate employees and users that AI apps may collect data on their contacts, not just themselves, and that sharing access to contacts or social graphs carries third-party privacy risks.
  • Establish a clear policy requiring review of AI app privacy policies before organizational or personal adoption.

Long-term improvements

  • Advocate for and implement Privacy-by-Design principles when evaluating third-party AI tools, requiring data minimization and explicit consent mechanisms for all data subjects.
  • Engage legal and compliance teams to assess whether AI tools processing relational or social data meet GDPR Article 5 (data minimization), CCPA, and other applicable regulatory requirements.
  • Require vendors to provide Data Processing Agreements (DPAs) that explicitly define what relational or social graph data is collected, retained, and shared.

Back this up with a control

All controls and vendors

Training helps people spot this. These controls make the attack fail even on the day someone does not.