That’s exactly my question reading this. Granted I don’t know much about the training side ofbLLMs, so maybe there’s more code changes involved there than I expect, but in terms of public-facing software, they make, what, a couple chat apps, a product website, and an API?
But they can’t do this unless you agree to enable training on your data. They would never train on raw user data. Only people who have consented and only after de identification.
Given how much PII is fed through these systems, would it being opt-out by default not be violating the GDPR by a failure to require explicit consent (or otherwise provide the legal basis for processing)? If a court decides as much, I imagine it would mean that all data harvested this way must be extracted from the models, and all instances where it would have been shared would have to be identified, which would really be something.
reply