Meta’s Muse builds detailed profiles of users’ friends, family and colleagues

During a routine chat with Muse, researcher Karan Joshi was shown the internal instructions that govern how the assistant organises its memory. The excerpt confirms that Muse generates a separate page for each individual referenced by the user, ranging from close family members to casual acquaintances and even accounts that the user follows on social media.

Meta’s public statement frames the feature as a transparency tool. According to the company, every user can access these pages, which are meant to give a clear view of what the AI knows about the people mentioned in conversations.

Structure of the automatically generated pages

Each page is divided into several sections. The “Facts” area lists verifiable data such as birthdays or publicly known positions. The “History” records when the person was first mentioned and any subsequent updates. The “Relationship” field describes how the user is connected to the individual, while “Common Points” captures shared interests, projects or goals.

A “Pending Discussions” segment flags topics that have been raised but not yet resolved, and a “Ways to Strengthen the Bond” section suggests actions the user could take, for example sending a congratulatory message on a milestone. Importantly, the system is instructed to leave a field blank rather than fabricate information when data is missing.

Data sources and isolation mechanisms

Meta asserts that Muse draws exclusively from two sources: publicly available information and the data the user explicitly supplies during interactions. To prevent cross‑user contamination, each user’s Muse instance runs inside a dedicated virtual machine that is inaccessible to other agents or users.

The company also highlights user controls. Users can delete any stored memory, disconnect Muse from external services, and must confirm actions such as sending an email or making a purchase. All of these operations are logged, providing an audit trail that can be reviewed by the account holder.

Criticism and privacy concerns

Privacy advocates focus on the indirect profiling of third parties who have never interacted with Muse. Because the assistant aggregates data about people mentioned by a user, those individuals can acquire a detailed dossier without giving consent or even being aware of the collection.

• Potential for inaccurate or outdated information
• Lack of direct consent from the profiled individuals
• Risk of misuse for targeted advertising or manipulation
• Difficulty for third parties to request deletion or correction

The Wired article published on 2026‑10‑05 notes that the automatic creation of these pages could lead to “shadow profiles” that extend Meta’s data ecosystem beyond the original user base. The Next piece, dated 2026‑10‑06, adds that the sheer volume of stored personal details may overwhelm users’ ability to manage or audit the information.

Meta’s response emphasizes that the feature is optional and that users retain full control over deletion and disconnection. Nevertheless, the company has not provided a mechanism for the people described in the pages to request removal, a gap that regulators are likely to scrutinise.

For English‑speaking organisations, the practical impact is twofold. First, internal policies must account for the fact that an employee’s use of Muse could unintentionally generate profiles of clients, partners or competitors, exposing the firm to data‑privacy liabilities. Second, the audit logs and deletion tools give IT departments a concrete way to demonstrate compliance, but they also require clear procedural guidelines to ensure that any third‑party data is handled in line with GDPR, CCPA and similar frameworks.

Guidance for compliance teams

Compliance officers are advised to incorporate Muse‑generated profiles into existing data‑mapping inventories, to flag any third‑party entries for review, and to establish a formal request process for subjects who wish to exercise their data‑subject rights.

In Paris, legal counsel for a multinational corporation warned that the lack of a direct opt‑out for profiled individuals could trigger fines under the French Data Protection Act, urging swift policy updates before wider deployment of Muse across European subsidiaries.