Your Bluesky posts could be training AI models right now

Bluesky’s popularity has skyrocketed in recent weeks. In the midst of an “exodus” of X/Twitter users, millions found in Bluesky the ideal alternative. Being designed as a competitor to Twitter, the platform is quite similar in terms of core functionality. However, it seems that BlueSky’s conditions regarding AI and post privacy are not as good as many expected.

One of the changes in X that triggered a user migration campaign is related to artificial intelligence. The new terms of use allow Elon Musk’s platform to train its AI-based developments with user posts. While many might not care about this, there are others—such as artists—who viewed the new policy with concern.

That said, it seems that your posts on Bluesky are not so safe to be used for AI training. It’s noteworthy that the social platform has committed to not doing so. This statement reassured the people who left X for that very reason. But while Bluesky won’t train AI on your content, nothing prevents third parties from doing so.

The origin of the controversy: millions of Bluesky posts available for AI training

Last week, Daniel van Strien, a machine learning librarian at Hugging Face, shared a dataset consisting of a million Bluesky posts, sparking a controversy. If you’re not aware, Hugging Face is an open-source machine learning library platform. That means the datasets are available for free use, including AI training.

Of course, the news was not well received by users who moved to Bluesky specifically to escape permissive policies regarding AI training. Hours after the backlash, Daniel van Strien removed the dataset and publicly apologized. “While I wanted to support tool development for the platform, I recognize this approach violated principles of transparency and consent in data collection. I apologize for this mistake,” he said.

One of the features that sets Bluesky apart from other platforms is its decentralized nature. This has advantages, such as greater control by individuals over their content. However, it also means that posts are available in a public feed. So, third parties have full access to them, including the profiles of users who posted them.

When the third parties are professionals, such as researchers, they usually follow ethical guidelines for handling datasets. For example, they anonymize each post so that it cannot be linked to anyone. They also offer options for users to request the removal of their content from the dataset. However, as many will be aware, the internet is full of trolls.

More datasets with millions of BlueSky posts emerged

Seeing the reaction of Bluesky users to Daniel van Strien’s original post, new datasets containing millions of posts from the social platform quickly started to emerge. The descriptions of the datasets on Hugging Face often explicitly state that they can be used for AI training.  After all, that will only further irritate those who were upset by the first shared dataset, right?

The collection of third-party data did not follow any professional guidelines. This means that publicly available datasets include not only ...s but also the nicknames of the people who created them. The situation escalated to the point that the largest dataset spotted so far features almost 300 million posts from users of X’s rival.

PygmalionAI affiliate Alpine Dale revealed that he compiled a dataset with two million posts. PygmalionAI is an LLM that is especially popular among users of role-playing-focused chatbots. This dataset hasn’t been shared yet, but the description on the website says that it “could be used for: Training and testing language models on social media content; Analyzing social media posting patterns; Studying conversation structures and reply networks; Research on social media content moderation; Natural language processing tasks using social media data”

There’s also Alim Maasoglu, an individual “dedicated to developing immersive products within the artificial intelligence space.” The description of his dataset on Hugging Face, comprised of some eight million Bluesky posts, says that it “aims to provide researchers and developers with a comprehensive sample of real world social media data for analysis and experimentation.” The description also mentions that the dataset is “growing,” so it will get bigger over time.

The biggest one has almost 300 million posts

That said, none of the above comes close to the Hugging Face user who goes by the nickname GAYSEX, with obvious intentions to troll. Their dataset includes nothing more and nothing less than 298 million posts from Bluesky users.

The description of the GAYSEX dataset shows their intentions in an ironic way. “NOOO you can’t do this!’ Then don’t post. If you don’t want to be recorded, then don’t post it. ‘But I was doing XYZ!!’ Then don’t. Look. Just about anything on the internet stays on the internet nowadays. Especially big social network sites. You might want to consider starting a blog. Those have lower chances of being pulled for AI training + there are additional ways to protect blogs being scraped aggressively,” it reads.

Ironically, although this dataset has the most Bluesky posts, it is also the least useful for training AI models. The user scraped the data without much care, order, or organizational structure. Basically, their goal was simply to collect as many posts as possible. They just wanted to far outperform the previous datasets that had been shared and cause more annoyance among the Bluesky folks. This dataset is “too unfiltered, so there’s gonna be a lot of work that needs to be done” to make it suitable for AI training.

Current data protection laws can do nothing about it

According to Samantha Cole’s report on 404 Media, at least six datasets containing millions of posts from Bluesky users are publicly available on Hugging Face. Moreover, it appears that current data protection laws are powerless to stop this. Cole consulted the situation with Neil Brown, a lawyer specializing in the General Data Protection Regulation (GDPR). “Merely processing the personal data of people in the EU does not make the person doing that processing subject to the EU GDPR,” Brown stated.

What determines whether similar actions are subject to GDPR is what a particular organization or individual does with the data. Merely publishing the dataset does not make it eligible to initiate a GDPR-based legal process. The processing of the data “would need to fall within its [GDPR] material and territorial scopes” for that, adds Cole. By “material and territorial scopes” she refers not only to what someone does with the dataset but also to the region in which they do it.