Meta’s Muse AI Builds Hourly Dossiers on Users, Their Contacts, and Private Conversations
What Happened — Meta’s newly released Muse personal‑AI assistant continuously harvests and stores a wide range of personal data—including calendar entries, emails, messages, and even sensitive attributes such as political opinion or biometric information. Internal prompts analyzed by TIME show the model refreshes user dossiers every hour and retains conversation histories in Meta‑controlled cloud storage, with encryption promised but not yet available.
Why It Matters for Trust & Control Assurance
- The practice tests the control objective of data‑privacy and consent management – organizations must demonstrate lawful collection, purpose limitation, and the ability to audit data handling.
- Continuous, opaque data aggregation creates a gap in evidencing compliance with privacy frameworks (e.g., GDPR) and hampers a defensible audit trail.
- Verisq’s CookiePLUS Privacy capability helps you map, monitor, and document consent, data‑type inventories, and encryption status across all third‑party services.
Who Is Affected – Consumers of personal‑AI assistants, SaaS platforms integrating AI, and any business that relies on user‑generated data for personalization or marketing.
Recommended Actions
- Conduct a privacy‑impact assessment (PIA) focused on data‑type inventory and consent flows for any AI‑driven service.
- Verify that encryption‑at‑rest is operational before enabling it; document the configuration as audit evidence.
- Update your data‑retention and deletion policies to reflect hourly dossier refreshes and ensure opt‑out mechanisms are enforceable.
Source: Malwarebytes Labs
Technical Notes
- No known vulnerability; the risk stems from product design that collects 31 of 35 possible data types, including “Sensitive Info” categories defined by Apple.
- Data is stored in Meta’s cloud; encryption is announced but not yet released.
Source: TIME analysis