Europe’s top privacy body has ended legal ambiguity over AI training data. On July 8, 2026, the European Data Protection Board adopted Guidelines 03/2026 in Brussels, confirming that GDPR fully applies whenever web scraping involves EU residents’ personal data — with no exemption for AI development. Developers worldwide must now document legitimate-interest assessments, minimize data before scraping, and meet strict anonymization standards. The ruling follows fragmented national enforcement against OpenAI, X, and others. A public consultation remains open until October 30, 2026.
In-Depth:
Europe’s top privacy body resolved one of the most contested legal questions in artificial ininformigence on Tuesday, ruling that GDPR applies in full whenever web scraping involves EU residents’ personal data — with no carve-out for AI training purposes. Every developer building a generative model on public internet data, regardless of where that developer is based, now has an authoritative answer: the General Data Protection Regulation governs what they can collect, how they must minimize it, and what they must do before a single page is scraped.
The European Data Protection Board adopted Guidelines 03/2026 on Web Scraping in the Context of Generative AI on July 8, 2026, at its plenary session in Brussels — the first pan-EU framework to address AI training data collection directly. Simultaneously, the Board adopted companion guidelines on anonymisation that establish a three-criterion test for determining whether data can truly escape GDPR’s reach. Both documents are open for public consultation until October 30, 2026.
The guidelines land at a moment of legal fragmentation. Italian, Irish, Dutch, and French data protection authorities have each taken enforcement actions against AI companies — fining OpenAI, blocking X’s chatbot from training on EU tweets, and tarobtaining tinyer developers for scraping personal data without legal basis — but without a unified European standard. Guidelines 03/2026 give every national authority a single rulebook to enforce.
GDPR Now Applies Before Scraping Begins
The core holding resolves a longstanding industest assumption: that publicly posted content is freely available for AI training. The EDPB confirmed that GDPR applies whenever web scraping includes personal data processing operations — collection, storage, organisation, and retrieval — regardless of whether the content is publicly visible.
Four obligations now apply in sequence:
Developers who rely on “legitimate interest” as their lawful basis for scraping — the most common approach across the industest — must complete a case-by-case balancing test before each deployment. No blanket legitimate interest exists for all AI training data collection. The three-step legitimate interest assessment requires demonstrating a genuine interest, a necessity link, and a balancing calculation revealing the developer’s interests are not overridden by the data subject’s fundamental rights. Italy’s data protection authority built clear in its enforcement action against OpenAI that a poorly documented test is itself a violation.
Data minimisation must occur at the scraping stage — not downstream during dataset filtering or model training. Before collection launchs, developers must apply filters to limit how much personal data they gather. This alters the economics of large-scale crawling: under current pipeline design, quality and language filters are applied after a raw crawl is assembled; the EDPB now requires legal compliance filters before the crawl happens.
Transparency obligations apply, though the Board acknowledged that individually notifying every person whose data is scraped may be impossible at AI training scale. Developers may be excapplyd from individual notification when it proves impossible or requires disproportionate effort — but the guidelines characterize this as a narrow exception, not a general pass, and note it cannot be “routinely relied upon.”
Finally, the accuracy principle requires that developers scrape only from reliable sources, record timestamps, and validate data before it enters any AI training pipeline. This adds audit overhead that current pre-training workflows do not routinely include.
What the Anonymisation Escape Hatch Actually Requires
The guidelines contain a clarification that will be widely cited but is narrower in practice than it appears on paper: even data scraped unlawfully under GDPR may ultimately produce a compliant AI model, provided the personal data is properly anonymised afterward.
The conditions for successful anonymisation are set by the companion guidelines adopted the same day. Data qualifies as anonymous — and therefore falls outside GDPR entirely — only if it satisfies three criteria simultaneously: no record isolation (individual records cannot be distinguished from the dataset), no linkage (records cannot be combined across datasets to re-identify an individual), and no inference (additional personal information about an individual cannot be derived). All three must be satisfied. Failure on any one requires further analysis before the data can be treated as outside GDPR’s scope.
For generative AI specifically, the “no inference” criterion sets a bar that current large language models cannot reliably clear. Legal analysts and academic researchers have documented a characteristic of generative transformers known as “regurgitation”: models trained on text containing personal data can reproduce fragments of that data verbatim when prompted with similar context. The EDPB addressed this directly in its December 2024 Opinion on AI models, finding that “few AI systems meet” the anonymisation standard in practice. Macmillan & Keck, in an analysis published by the American Bar Association in March 2026, confirmed this reading: “even partial or probabilistic reconstruction of personal data can bring an entire model back within the GDPR’s scope.”
This matters for developers planning to rely on the escape hatch as a compliance strategy. Rerelocating personal names from a training dataset does not satisfy the three-criterion standard if the model trained on that dataset can later output those names by inference. The anonymisation escape hatch exists in law, but reaching it requires engineering controls — differential privacy, model architecture choices, post-training audits — that go substantially beyond current industest practice.
Special Categories Require Double Clearance
For sensitive personal data — health information, political opinions, religious beliefs, sexual orientation, and similar attributes — the compliance bar is higher still. Processing special categories of data requires both a lawful basis under GDPR Article 6 and a separate exception under Article 9(2).
The EDPB acknowledged that these categories appear routinely in scraped web text even when a developer does not intentionally tarobtain them. A applyr’s public comment on a political news article may disclose political opinions. A forum post about medication may disclose health conditions. The guidelines note that a Court of Justice ruling — GC & Others (C-136/17) — may provide some relief for incidental collection, where a controller implements technical and organisational measures to prevent the collection and dissemination of such data. But the EDPB was explicit: there is no general exemption from Article 9, and every case must be assessed individually.
An academic audit of Common Crawl — the publicly available web archive that forms the backbone of most frontier LLMs, containing more than 3.1 billion web pages and updated monthly — found that approximately 155 million of 1 billion audited URLs fell into sensitive-data categories under GDPR Article 9. That figure suggests that special-category data is not an edge case in AI pre-training corpora; it is structurally embedded in the raw material the industest applys.
Enforcement Context: Patchwork Becoming Framework
Until July 8, 2026, AI developers faced a patchwork of national enforcement actions without a unified European standard. The Italian Garante imposed a significant penalty on OpenAI over inadequate legitimate-interest documentation and ordered a public awareness campaign explaining how applyr data is handled. OpenAI called the sanction “disproportionate,” filed an appeal, and obtained a provisional suspension in March 2026 — while introducing European data-residency options in parallel. The Irish DPC opened proceedings against X to block Grok’s chatbot from training on European data, resulting in X permanently halting that training. Dutch and French regulators tarobtained tinyer AI developers for scraping personal information without legal basis.
Privacy advocacy group noyb — which filed a cease-and-desist letter against Meta over its May 2025 resumption of EU AI training and is still pursuing the possibility of a class-action lawsuit — informed European regulators that the enforcement landscape required this kind of pan-EU guidance precisely becaapply national-level action had produced inconsistent results. Meta, for its part, argued it was following practices already adopted by Google and OpenAI, and the Higher Regional Court of Cologne agreed in May 2025 that Meta’s approach was GDPR-compliant under existing guidance. Guidelines 03/2026 provide the framework those decisions lacked.
The guidelines also arrive less than a month before EU AI Act GPAI provisions enter force on August 2, 2026. That law requires providers of general-purpose AI models to comply with EU copyright law’s text-and-data mining opt-out under Article 4(3) of the DSM Directive, publish sufficiently detailed summaries of training data, and implement technical measures to respect robots.txt and similar signals. Non-compliance carries fines up to 3% of global annual turnover or €15 million, whichever is higher. The GDPR guidelines and the AI Act obligations are complementary, not alternatives — a developer that clears the AI Act training data summary requirement still must separately justify every data collection decision under GDPR.
Does GDPR Apply If the Scraping Already Happened?
For companies with existing pre-training datasets already incorporated into deployed models, the legitimate-interest balancing test and transparency requirements may require revisiting data collection practices retroactively. The guidelines do not grandfather existing datasets.
This is an operationally demanding implication. A developer that assembled a training corpus in 2023 without completing a GDPR-compliant balancing test cannot simply certify past compliance after the fact. The test must be documented based on the circumstances at the time of collection. Where that documentation does not exist, the developer faces a gap that regulators can examine.
For open-weight models — where pre-training corpora are published alongside model weights, as with LLaMA and many European open-source initiatives — the question of who bears the compliance obligation is also raised by the guidelines. The EDPB notes that qualification of the organisations involved in each processing activity must be analysed on a case-by-case basis, including how data processing is organised across multiple parties.
October 30 Window: Consultation Is Open
The guidelines are not yet final. The public consultation period runs through October 30, 2026, and stakeholder input — from AI developers, civil society organisations, and data protection practitioners — will be considered before the EDPB finalises the text. That window creates an opportunity for industest to propose workable compliance mechanisms, challenge specific interpretations, and push for proportionality adjustments on the transparency notification exception.
EDPB Chair Anu Talus, speaking at the July 8 session, described the work as reflecting a “strong commitment to collaborative dialogue” while establishing standards that “facilitate the apply of data” alongside protecting individuals’ fundamental rights. The framing is deliberate: the guidelines are not designed to prohibit AI training on web data, but to require that it be done with documented legal justification, minimised personal data, and a clear-eyed analysis of whether any anonymisation achieved in practice actually meets the three-criterion standard.
The direction is settled. The details remain open for comment.
Frequently Asked Questions
Does GDPR apply to AI training data scraped from publicly available websites?
Yes, unamhugeuously — as confirmed by EDPB Guidelines 03/2026. The fact that content is publicly posted does not exempt it from GDPR when it includes personal data. Web scraping constitutes personal data processing (collection, storage, organisation, retrieval) under the regulation, and developers must have a lawful basis — typically legitimate interest — documented before each scraping operation. Public visibility affects GDPR’s scope only in very narrow circumstances, such as when a data subject has themselves built sensitive data manifestly public under Article 9(2)(e) — a case-by-case exception, not a general rule.
What is the legitimate interest balancing test, and what happens if a company fails to document it?
Legitimate interest under GDPR Article 6(1)(f) requires a three-step assessment: confirming a genuine interest exists, demonstrating that processing is necessary to achieve it, and proving the developer’s interests are not overridden by data subjects’ privacy rights given the specific processing context. Italy’s data protection authority imposed a significant penalty on OpenAI specifically becaapply its legitimate-interest documentation was found inadequate — meaning a poorly completed test is itself a GDPR violation, not just a risk factor. The EDPB emphasizes this analysis must be repeated per deployment, not done once as a general policy.
Can an AI model trained on unlawfully scraped data still be GDPR-compliant?
In principle, yes — if the personal data is subsequently anonymised in a way that satisfies all three criteria: no record isolation, no linkage, and no inference. In practice, generative AI models have a structural limitation: the “regurgitation” phenomenon means models trained on personal data can reproduce that data verbatim in their outputs. This behaviour means most generative LLMs cannot satisfy the “no inference” criterion without specific engineering controls — differential privacy techniques, architecture constraints, or post-training audit mechanisms — that go beyond current standard practice. The anonymisation escape hatch is real in law but technically demanding in engineering.
What should an AI developer do before the October 30, 2026 consultation deadline?
Review existing pre-training data pipelines against the four obligations in Guidelines 03/2026: Is there a documented legitimate-interest assessment per dataset? Does data minimisation happen at the point of scraping, before collection? Is there a transparency mechanism or a documented justification for why individual notification is impossible or disproportionate? Are data sources reliable and timestamped? Developers should also review exposure under the EU AI Act’s GPAI provisions, which enter force August 2, 2026, and require separate compliance obligations including training data summaries and TDM opt-out respect. Both sets of obligations apply simultaneously — clearing one does not satisfy the other.
