Meta Llama
Meta
Assessment labels are editorial guidance, not GDPR certifications. Validate the exact plan, lawful basis, DPA, subprocessors, retention, residency and feature settings. EU storage and no-training terms alone do not establish GDPR compliance. ¹ No training applies under the reviewed plan’s terms.
Pricing / Contract Route
Weights may be downloaded under licence; hosting/API costs vary
Enterprise Features
Self-hosting control; hosted-provider controls depend on the selected provider
Last Updated
September 10, 2026
Reviewed on 10 September 2026 by WAIMAKERS B.V.
1 Purpose
There is no single “Llama service”. A downloaded model, Meta AI, Meta's limited Llama API and a third-party hosted Llama endpoint have different controllers, data flows and terms. A Llama deployment can support GDPR compliance only after the actual route is assessed.
2 Comparison of Llama deployment options (EU focus)
| Route | Who receives prompts | Main privacy question | Practical assessment |
|---|---|---|---|
| Self-hosted Llama weights | The operator and any infrastructure providers it chooses | Logging, access, lawful basis, retention, security and output governance | High infrastructure control; the operator remains accountable. |
| Meta AI consumer service | Meta under the applicable Meta service terms | Consumer data use, objection controls, retention and transfers | Do not approve for confidential organisational data without a separate assessment. |
| Meta Llama API preview | Meta | API terms, retention, region, DPA and availability | Meta said preview prompts and responses were not used to train models, but procurement details must be confirmed. |
| Third-party Llama hosting | The selected cloud or inference provider | That provider's DPA, regions, logs, training and subprocessors | Assess as a separate vendor route; the word “Llama” proves none of these properties. |
Notes for Europe
Meta stated at LlamaCon in April 2025 that its limited free Llama API preview did not use prompts or responses to train Meta AI models. That statement does not establish current availability, retention, EU residency or a DPA for every later API offering.[1]
Using downloadable weights does not send prompts to Meta by itself. It also does not make a system automatically compliant: the deployer determines purposes and lawful basis, configures logs and deletion, secures the environment, handles rights requests, and assesses whether model inputs and outputs contain personal data.
3 Is Llama GDPR-compliant?
✅ Self-hosted weights: controlled by the deployer
- ✅ Model weights alone do not send prompts to Meta.
- ✅ The deployer chooses infrastructure, access, logs and retention.
- ⚠️ Those choices create operator responsibilities; they do not automatically establish compliance.
⚠️ Meta-managed and third-party services: separate assessment
- Verify the current DPA, processor roles, region, transfers, retention, training terms and subprocessors.
- Do not apply a Meta AI consumer-policy answer to an API or self-hosted route.
4 Details by offering
Self-hosted Llama
Using downloadable weights does not send prompts to Meta by itself. The deployer determines purposes and lawful basis, configures logs and deletion, secures the environment, handles rights requests, and assesses whether model inputs and outputs contain personal data.
Meta AI consumer service
This route follows Meta's consumer terms and training/objection controls. It should not be used for confidential organisational data without a separate approval.
Meta Llama API
The April 2025 preview announcement included a no-training statement, but current availability, retention, EU residency and DPA coverage remain procurement questions.
Third-party hosting
The selected cloud or inference provider determines managed-service privacy properties. “Powered by Llama” is not evidence of an EU region, no training or a DPA.
5 Licensing and EU scope
Llama is distributed under Meta's Llama Community License, not an OSI licence. The Llama 4 licence requires attribution and a separate licence for an organisation or affiliates with more than 700 million monthly active users at the release date.[2]
The Llama 4 Acceptable Use Policy withholds rights to use the multimodal models from individuals domiciled, or companies with a principal place of business, in the EU. It expressly says this restriction does not apply to end users of a product that incorporates such a model. Check the exact model version: this is a licence condition, not a general ban on all Llama versions or all EU end users.[3]
6 Meta AI training is a separate issue
Meta announced that, for its EU consumer services, it would train AI models using adults' public posts and comments and interactions with Meta AI, while providing a right to object. Meta said private messages with friends and family and public data from people under 18 were excluded unless information was shared with Meta AI.[4]
The Irish Data Protection Commission stated on 21 May 2025 that Meta had made changes after regulatory engagement and that the DPC would continue to monitor the processing. That statement was not a blanket finding that every Meta AI or Llama deployment complies with GDPR.[5]
Do not transfer this Meta AI training analysis to self-hosted weights or to the Llama API. Conversely, a no-training API statement says nothing about a consumer Meta AI account.
7 Data processing flow
| Route | Simplified flow |
|---|---|
| Self-hosted | User → operator infrastructure → Llama model; Meta is not a prompt recipient unless the operator adds Meta services |
| Meta AI | User → Meta consumer service → Meta-controlled processing under the applicable consumer terms |
| Meta API | Application → Meta-hosted API → response; current contract, region and retention must be confirmed |
| Third-party host | User/application → chosen provider → model; that provider's terms and subprocessors apply |
8 Recommendations (GDPR-first)
- Prefer a documented EU self-hosted or third-party business route when the organisation can govern the full stack.
- Review the exact model card, licence and acceptable-use policy for the release being deployed.
- ⚠️ Treat Meta AI, Meta API and every third-party endpoint as different supplier routes.
- ❌ Do not send confidential or special-category data through an unapproved consumer or preview service.
9 EU rollout checklist
For self-hosting, document the model licence, hosting region, infrastructure processors, access controls, input/output logs, deletion periods, rights workflow, security testing and prohibited uses. Review the model card and licence for the exact release rather than assuming every Llama version has identical terms.[6]
- Record the exact model and licence version.
- Map every prompt recipient, external tool and infrastructure processor.
- Set access, logging, retention and deletion rules.
- Complete rights, incident and output-governance procedures.
- Test that the deployment does not make undeclared external calls.
For any hosted route, obtain the current order form, DPA, subprocessor list, transfer mechanism, region commitment, retention schedule, training clause and incident terms. Do not infer SOC 2, ISO certification or EU residency from the model family.
Prices, model availability and preview limits are volatile and are not privacy evidence. Confirm them in the selected provider's current commercial terms.
10 Procurement quick answers
Does self-hosting give control? Yes, if the stack is actually self-contained; the operator then carries the GDPR and security duties.
Does Meta train on every Llama prompt? No. Self-hosted weights, Meta AI, the historical API preview and third-party hosts have different data flows.
Is Llama open source? Meta distributes it under the Llama Community License, which includes version-specific conditions.
Can every Llama 4 model be offered from the EU? The Llama 4 multimodal acceptable-use terms contain an EU establishment restriction for providers, with a stated end-user exception. Check the exact release.
Notes and caveats
Model licences, hosted services and preview availability change. Recheck the exact release and provider contract before deployment.
Conclusion
Meta Llama requires a deployment-specific review. Self-hosting can provide strong control but leaves the operator responsible for GDPR compliance. Meta AI, Meta's API and third-party endpoints are distinct services and must not be described with one training, retention or residency answer.
Disclaimer
This is an editorial procurement assessment, not a legal determination or legal advice.
References
See sources [1] through [6] linked at the relevant claims above.