Key facts at a glance

• Meta’s Muse AI assistant has reportedly passed 10 million users, with about a quarter using it daily.
• Muse is an agentic assistant that can connect to email, calendars, messaging, contacts, files, financial data, health data, location, and more.
• When a Muse user asks the assistant to summarize or draft a message, names, dates, medical details, travel plans, and other information about non-users can be included in the request and response.
• Some Meta-owned services can connect automatically when Muse uses the same account credentials; third-party connectors broaden access to calendars, email, reservations, documents, finance, music, and health devices.
• Meta says non-user data processed by Muse is not linked to a Meta account and is not stored in a way that allows the company to “reasonably identify” which information belongs to a particular person.
• Muse’s cloud-based virtual machine does not yet offer the confidential VM option described in its privacy policy.
• AI model training is enabled by default for Muse users unless they opt out; Meta says it removes certain categories of personally identifiable information and disassociates interactions from accounts.
• Non-users have no direct opt-out mechanism and must rely on privacy laws, requests to their contacts, or platform protections that advocates say are insufficient.

Meta’s Muse AI assistant was designed to be the kind of always-on helper that can read, plan, book, summarize, and act. That convenience has a cost that extends beyond the person who installs it. Launched on Sept. 8 and promoted as “AI that gets it done,” Muse is an agentic assistant that can connect to a user’s email, calendar, contacts, files, and other services to complete tasks. Meta has said adoption has surpassed 10 million users, and that roughly 25% of them use the assistant daily. Common activities include shopping, managing email, and coordinating calendars.

The privacy question is not only about what Muse does for its users. It is also about what happens to the information those users carry with them — messages, meeting invitations, travel plans, medical updates, financial discussions, and casual conversations — when an AI assistant processes it. A person can choose not to use Muse and still have their data swept into its requests and responses because someone else in their life does.

What Muse is and why non-users are affected

Muse is part of a broader shift toward agentic AI, where assistants do more than answer questions. They are given access to applications and asked to perform tasks on a user’s behalf. That means an assistant may read an email thread, inspect a calendar, summarize a message, draft a reply, or gather details from multiple services. Each of those actions can pull in information about other people.

In hands-on testing, Muse has been described as a polished product that demands a significant amount of sensitive access. It asks for permissions tied to contacts, calendars, email messages, and even logins and passwords. On mobile, its app store listing indicates that Muse may collect a wide range of data categories, including photos and videos, financial information, app performance data, files and documents, app activity, personal information such as name, email address, user IDs, address, and phone number, contacts, web browsing, health and fitness data, messages including emails and SMS or MMS, audio, location, and calendar events.

Those permissions are not unusual for a powerful assistant, but they create a broad surface for data collection. The assistant can work around the clock, interact with a browser, and operate inside a cloud-based virtual machine. It can also enable AI model training by default unless the user changes settings. Combined with Meta’s long history of privacy scrutiny, the setup raises red flags not just for users but for the people who communicate with them.

How non-user data enters Muse

Muse users opt in, launch the assistant in Meta’s cloud, and connect it to apps and services. Their contacts have not necessarily done the same. Meta has acknowledged that Muse can gather information about non-users in several ways, including when a user connects the assistant to apps and services that contain data about other people. A user may also submit information about themselves and others in text, images, videos, or uploaded documents.

The company has offered a simple example: if a Muse user connects a calendar app and asks what meetings are scheduled for the week, the names of attendees and event details could be included in the request and response. The same logic applies to email, messaging, and other communication tools. If a user asks Muse to summarize a thread or craft a response, the assistant may read content that includes sensitive information belonging to someone else.

That information can be highly personal. Travel itineraries, medical problems, job searches, financial concerns, family updates, and private conversations can all be processed by an AI assistant that the other person did not consent to and does not use. The non-user may never know that their message was read by an assistant, summarized, stored, or used to improve a model.

Meta has said that because the person using Muse chooses what they share and what they request through the assistant, the company cannot predict exactly what information about a non-user may be included. That position places the practical control in the hands of the Muse user, not the person whose data is being discussed.

Connectors widen the data pipeline

A major part of the issue is what Meta calls Connectors, the bridge between a Muse virtual machine and third-party services through APIs. Some Meta-owned services connect automatically if the Muse account uses the same credentials as the Meta Account Center. Beyond that, third-party connectors can link calendars, email, reservations, documents, finance, music, health devices, and other services. If a connector is not available, a user can ask Muse to make an API call and try to create one to another service on their behalf.

This design is meant to make the assistant useful. It also means that a single request can pull data from multiple sources at once. A user might ask Muse to coordinate a dinner, summarize a family email chain, prepare for a meeting, or plan a trip. In doing so, the assistant may collect names, addresses, availability, dietary restrictions, health details, payment information, and other data about people who never agreed to the arrangement.

Critics argue that Meta has not done enough to protect bystanders. A privacy advocate might reasonably ask why non-users have no meaningful notice, no consent screen, and no simple way to see what a friend’s assistant has processed about them. The burden instead falls on individuals to ask their contacts not to share personal information with an AI assistant, which places strain on interpersonal relationships and assumes that everyone understands the risks.

Privacy advocates have warned that without stronger platform protections, Muse can become a problem even for people who actively choose not to engage with it. Muse may also search the web for publicly available information related to a person, which fits with the company’s broader approach to data scraping. Public information can be combined with private context in ways that create detailed profiles of contacts, family members, and colleagues.

The limits of Meta’s anonymization promise

Meta does not promise full anonymization. Instead, the company says that if non-user data is viewed or ingested by Muse, it will not be linked to a Meta account and will not be stored in a way that allows Meta to reasonably identify which information belongs to a particular person. That standard of “reasonable identification” is weaker than full anonymization, in which personal identifiers are stripped so that no one can identify a data subject.

The distinction matters because anonymized data is often treated differently under privacy laws. If information is only handled so that Meta cannot reasonably identify a person, it may still retain enough context to be sensitive. Names might be removed, but a combination of dates, locations, relationships, and event details can still reveal who is involved. The promise also does not give non-users a way to inspect, correct, or delete the information that was processed.

Meta has also said that information may be used or shared as described in the Muse privacy policy. At the moment, Muse operates in a cloud-based virtual machine. The policy says that in the future there will be an option for a confidential VM that keeps people’s information private even from Meta. That private environment is not currently available. For non-users, that means the strongest privacy architecture described by the company is still a future promise rather than a present safeguard.

AI training and user controls

Another concern is AI model training. Muse interactions could be used to improve Meta’s AI systems, and that could include data related to non-users. To prevent this, a Muse user must turn it off under settings and data controls. Meta has said that if users allow training, the company still removes certain categories of personally identifiable information, such as names, email addresses, phone numbers, and Social Security numbers, and disassociates the interactions from the user’s account.

That may reduce some risks, but it does not eliminate them. Removing names and account links does not necessarily remove meaning from a conversation. A message thread about a specific illness, a family event, a workplace dispute, or a financial decision can remain sensitive even after direct identifiers are stripped. Non-users also have no way to verify what was removed or what remains in a training dataset.

For Muse users, the controls are at least available. They can turn off AI training and adjust permissions, although the effectiveness of denying the assistant certain privileges has been questioned. For non-users, the options are far more limited. They may have a right to object under data privacy laws in their home location, but even that may not apply to Muse conversations. In practice, a non-user may have to rely on the conscience of the person who uses the assistant.

Privacy law experts have noted that asking a friend or family member not to share personal information may sometimes work, but it places a burden on the relationship. Platforms, they argue, have the responsibility to protect people who do not consent to data collection by default. That is not happening here. The result is a system in which the most convenient path for the user creates risk for everyone else.

What non-users can realistically do

There is no straightforward opt-out for people who do not use Muse. They can ask contacts not to connect the assistant to messaging or email accounts, avoid sharing sensitive details in conversations with Muse users, and invoke privacy rights where local law provides them. Those steps are partial and depend on cooperation. They also require non-users to know that Muse is in the picture, which is not always obvious.

The broader implication is uncomfortable. People may have to reconsider what they say to one another, even in a private email or message, because the recipient may use an AI assistant to manage daily tasks. A message that feels private between two people can become input for a cloud-based system, a virtual machine, and potentially a training pipeline. The person who sent it has no direct relationship with the assistant and no easy way to withdraw the data.

Meta’s approach also raises questions about consent by proxy. A Muse user can agree to broad permissions and data practices, but that agreement cannot meaningfully cover the contacts whose information appears in calendars, inboxes, and message threads. The company says it cannot predict what information about a non-user may be included, which is precisely the problem: the data flow is open-ended, and the protections are general rather than specific.

The next phase of agentic AI may make the issue more visible. Meta is experimenting with AI making phone calls to businesses on behalf of Muse users. Business owners can request not to receive AI calls, but the development shows how assistants are moving from text and calendars into live interactions. Each expansion creates another channel through which data about non-users can be collected, processed, and acted upon. For now, non-users remain on the outside of a system that can read their messages, infer their plans, and include them in requests they never approved.

Source:ZDNET News