Llama 4 : Privacy and Data Review 2025

Here is our independent evaluation of Llama 4 (Meta), at the heart of the Web3 revolution and the quest for a sovereign and privacy-respecting AI. Based on an exclusive framework and a rigorous audit of publicly available data, this analysis reflects our vision of a future where privacy is a fundamental right.

The scoring system is based on a comprehensive guide created specifically for this project, accessible here. This ranking is dynamic, evolving with innovations and feedback from the decentralized community.

Our mission: to enlighten and inform, without filter or influence, to build together a fairer and more transparent AI ecosystem.

update : 25/08/07

Key Insights from the Llama Privacy and Data Review

Model

Data Collection

Prompts stored: Prompts and responses are not stored beyond the session, a strong privacy feature. However, other user data (e.g., identity, device info, usage patterns) may be retained without clear anonymization or deletion policies, posing privacy risks. Meta should guarantee no persistent prompt storage, anonymize all prompts by default, and define clear retention periods. C

Use for training: User data, even if anonymized, may be used to improve Llama 4, with no clear opt-out for standard users (self-hosting excepted). This lack of control and transparency over data use is concerning. A technical opt-out mechanism is needed. C

Account required: Personalized use requires an account with standard personal data collection. Anonymous use is limited to self-hosting, which is only feasible for technical users. Most users must share personal information. C

Data retention duration: User data is retained “as long as needed” for service or legal purposes, with no specific deletion timeline except for cookies (up to 400 days). This vagueness creates uncertainty. Meta should specify exact retention periods for all data types. C

User Control

Deletion possible: Account data can be deleted under GDPR, but the process may not be immediate or complete due to legal retention requirements. Full user control requires instant, total deletion by default. C

Export possible: GDPR-compliant data export is available, but the format and completeness are unclear. Standardized, usable formats (e.g., JSON, CSV) would enhance portability. B

Granularity control: Basic privacy settings are available, but fine-grained controls (e.g., per-prompt or per-interaction) are absent. Granular dashboards would empower users. C

Explicit user consent: Explicit consent for sensitive data and ads is GDPR-compliant and revocable, a strong transparency feature. A

Transparency

Clear policy: Meta’s privacy policy is detailed, readable, and regularly updated, clearly outlining data practices. A

Change notification: Users are notified in advance of major policy changes and can review them, a key transparency practice. A

Model documentation: Only high-level information on architecture, security, and data is provided, lacking detailed technical documentation. Full disclosure is needed for accountability. C

Privacy by Design

Encryption (core & advanced): Security is mentioned, but specifics on encryption methods (e.g., end-to-end) or certifications are absent, undermining trust. C

Auditability & Certification: No evidence of independent audits is provided. Regular, public audits would enhance transparency. D

Transparency & Technical Documentation: No advanced technical documentation on privacy or architecture, only high-level information. You can’t really see “under the hood” of Llama 4’s privacy protections. Full technical disclosure is needed for experts and users alike. C

User-Configurable Privacy Features: Basic privacy controls exist, but advanced customization (e.g., custom retention periods, prompt-level controls) is lacking. More flexible options would strengthen user control. C

Hosting & Sovereignty

Sovereignty: Self-hosting allows enterprises and advanced users to control data on their servers, a major privacy advantage. Non-technical users rely on Meta’s GDPR-compliant EU cloud, which is less flexible. A

Legal jurisdiction: Meta-hosted data falls under EU/Irish GDPR laws; self-hosted data follows local laws. Both offer strong legal protections. A

Local option: Self-hosting is available for enterprises and experts, but regular users are limited to Meta’s cloud. A local option for all users would improve flexibility. B

Big Tech dependency: Cloud users are tied to Meta’s infrastructure, while self-hosting offers independence but requires technical expertise. C

Open Source

Publicly available model: Llama 4’s weights are downloadable but come with usage restrictions, falling short of true open-source freedoms. No access to training data or full code is provided, limiting adaptability. B

Clear open source license: The custom “open weights” license restricts full open-source freedoms (e.g., sharing, modification). An OSI-approved license (e.g., MIT, Apache) would boost trust and innovation. C

Inference code available: Providing inference code enables self-hosting, a significant win for transparency and control, though primarily for technical users. A

Remarks