AIネイティブ時代のプライバシー対応インフラ：アセット分類ケーススタディPrivacy-Aware Infrastructure in the AI-Native Era: An Asset Classification Case Study

Privacy controls — the systems that enforce retention limits, access restrictions, allowed-purpose constraints, downstream-sharing rules, and anonymization policies — only work if the underlying platform actually understands what data it is governing. Meta's engineering organization has published a case study describing how it approaches data asset classification in what it calls the AI-native era, an effort that matters because the proliferation of machine learning systems has multiplied both the volume of data and the number of ways that data can move through an organization.

The core argument is straightforward: before any control can be applied, a company must know what each piece of data is, where it lives, and what obligations attach to it. At Meta's scale, this is not a manual task. The company operates an enormous number of data assets — tables, logs, files, model features, and derived datasets — spread across many systems. A retention policy that promises to delete a category of data after a fixed period is only meaningful if every asset holding that category has been correctly identified. The same logic applies to purpose limitation, where data collected for one reason must not be repurposed without authorization, and to anonymization, where a control must know precisely which fields carry personal information.

Asset classification, in this framing, is the foundational layer beneath all of those controls. The case study describes the challenge of assigning accurate semantic labels to data at a granularity fine enough to be useful. It is not enough to know that a table exists; the system needs to understand the meaning of individual columns or fields, because privacy obligations often apply to specific data elements rather than entire datasets. This is where the AI-native framing becomes relevant. Modern data flows increasingly pass through model training pipelines, feature stores, and inference systems, which can transform and recombine data in ways that make manual tracking impractical. Classification techniques therefore need to keep pace with how AI systems actually consume and produce data.

To meet that demand, large platforms generally combine several methods. Schema-based and rule-based detection can catch well-structured, predictable fields, while machine learning classifiers are used to infer the likely content of data when explicit metadata is missing or unreliable. Lineage tracking — following data as it moves from a source through transformations to downstream consumers — helps propagate classifications so that a label applied at the point of collection follows the data as it is copied and derived. Meta's discussion appears to emphasize building this understanding as a reusable infrastructure layer rather than as a one-off audit, so that the same classification signal can drive many distinct enforcement systems.

This work sits within a broader industry movement toward systematic data governance. Concepts such as data catalogs, metadata management, and policy-as-code have become common across large technology companies, and regulatory frameworks including the European Union's General Data Protection Regulation and various regional privacy laws have made accurate data inventory a compliance necessity rather than an optional engineering nicety. Meta has previously written about related internal systems for purpose limitation and policy enforcement, and the asset classification effort is best understood as a prerequisite that those higher-level systems depend on. Adjacent tooling in the wider ecosystem — open-source catalogs and commercial data-governance platforms — addresses similar problems, though the specifics of any one company's implementation reflect its own scale and architecture.

The AI dimension adds particular urgency. Training large models can involve ingesting broad swaths of data, and ensuring that restricted or sensitive information is handled according to policy requires knowing what is in those datasets before training begins. Reliable classification is also relevant to questions of data minimization and to the ability to honor deletion requests across complex pipelines. Without it, privacy commitments risk becoming aspirational statements that the underlying systems cannot consistently enforce.

The case study is presented as an account of an ongoing program rather than a finished product, and the techniques described are likely to keep evolving as data volumes and AI workloads grow. For engineers and policy teams elsewhere, the broader takeaway is that effective privacy engineering begins not with the controls themselves but with the often-overlooked task of understanding the data those controls are meant to protect.