Meta Touts Muse AI Agent, but Data Violation Track Record Is the Real Bet

Meta has officially introduced an artificial intelligence agent named Muse, designed to carry out tasks on behalf of users, from browsing the internet, shopping, analyzing banking data, recommending insurance policies, to digging up health information. The launch came with a massive public relations campaign to convince the public that Meta can be trusted to manage their personal data — a claim that immediately raised questions given the company's track record.

Muse works by accessing whatever data the user provides. The more sensitive information shared, the greater the value the AI agent can deliver. Meta has promised a series of data protection protocols, including assurances that information shared with the bot will not be accessed by outside parties, not even by Meta itself. But that promise comes amid a long history of privacy violations that makes the public hard-pressed to simply take it on faith.

Over nearly two decades, Meta has repeatedly run afoul of the law over alleged data misuse. In 2007, the Beacon program, which publicly exposed personal information, ended in lawsuits and the program's shutdown, along with US$9.5 million in compensation. That same year, Meta was forced to shut down an advertising program that used users' names and photos without permission. In 2011, the company was sued over tracking activity outside its platform, and only settled the case in 2022 by paying US$90 million.

Legal pressure has not let up. In 2019, the United States Federal Trade Commission imposed a US$5 billion fine related to the Cambridge Analytica scandal. A year earlier, a data leak exposed the personal information of about 30 million users. Turkish authorities fined Meta US$282,000 in 2019 for violating data protection laws, affecting nearly 300,000 people. In 2022, the Texas Attorney General's office sued the company over biometric data collection without consent, which ended with US$1.4 billion in compensation and the halt of the practice. Irish regulators also fined Meta US$461 million for violating children's privacy, as well as US$263 million in 2024 over a data leak affecting 29 million Facebook users.

More recently, in 2026, Meta agreed to pay US$18 billion to settle a case brought by a coalition of US attorneys general. The lawsuit accused the company of misleading the public about the mental health impact of its apps on children. In the same year, hackers managed to take over more than 20,000 Instagram accounts after tricking Meta's AI-based support bot — an incident that directly shook the security narrative the company was trying to build.

“Meta tends to view fines as a cost of doing business, not as a signal to change behavior,” according to an assessment from a number of digital policy observers, referring to the disparity between total fines and the company's revenue.

For Indonesia, this dynamic is not merely tech news. Meta controls a significant share of social media and messaging platforms in the country, with hundreds of millions of active accounts. If Muse eventually becomes available in the Indonesian market, users risk handing over financial, health, and digital habit data to a company that has not fully recovered from a crisis of trust. Domestic regulators, including the Ministry of Communication and Digital Affairs and the personal data protection agency, need to ensure that any AI agent operating in Indonesia complies with the Personal Data Protection Law, including mandatory algorithm audits and transparent incident reporting mechanisms.

At the global level, the European Union has shown that large fines may not be enough to make companies change their priorities. The question now: will Meta truly place data security as the foundation of Muse, or is that protection promise merely a marketing layer before users hand over more information? The answer will determine not only the future of consumer AI agents, but also the digital trust standards that apply worldwide.