Bluesky's Open API Sparks AI Training Controversy: One Million Posts Scraped Without User Consent

Bluesky's Data Scraping Incident

Bluesky, a decentralized social network gaining popularity as an alternative to X (formerly Twitter), has found itself at the center of a privacy controversy. A dataset containing one million public posts from the platform was scraped and uploaded to AI company Hugging Face, intended for machine learning research 1

1

. This incident has raised significant concerns about user privacy and consent in the age of AI.

The Dataset and Its Creator

The dataset was compiled by Daniel van Strien, a machine learning librarian at Hugging Face. It included not only the text of posts but also users' decentralized identifiers (DIDs) and metadata 2

2

. Van Strien's intention was to use this data for research related to natural language processing, social media analysis, and content moderation.

Bluesky's Open API and Vulnerability

The core issue stems from Bluesky's open and decentralized nature, built on the Authenticated Transfer (AT) Protocol. The platform's Firehose API provides an aggregated stream of public data updates, making it vulnerable to external scrapers 3

3

. This openness, while beneficial for third-party developers, has exposed a significant privacy risk for users.

User Consent and Platform Response

Bluesky users did not provide explicit permission for their posts to be used in this manner. The platform has stated that it will never train generative AI on user data, but it acknowledges that it cannot enforce this policy outside its systems 4

4

. Bluesky is now exploring ways to enable users to communicate their consent preferences to external parties, though enforcement will ultimately depend on outside developers.

Aftermath and Apology

Following the backlash, van Strien removed the dataset from Hugging Face and issued a public apology, acknowledging the breach of transparency and consent in his data collection approach 5

5

. This incident has sparked a broader discussion about data privacy and the ethical use of public information for AI training.

Implications for Social Media Users

This controversy serves as a reminder that content shared publicly on platforms like Bluesky is accessible to external entities. As Bluesky continues to grow, surpassing 20 million users, it will likely face increasing scrutiny regarding its data protection measures and user privacy policies.

Broader Context of AI Training and User Data

The incident highlights a growing trend in the tech industry where user-generated content is being used to train AI models. Other platforms like X and Meta have updated their terms of service to allow for such practices, while LinkedIn has introduced an opt-out option for users who don't want their data used for AI training.

Future Considerations

As AI technology advances, the balance between open platforms, user privacy, and ethical AI training becomes increasingly complex. Bluesky's situation underscores the need for clearer policies, user consent mechanisms, and industry-wide standards for the responsible use of public data in AI development.