EDPB draft Guidelines 03/2026

8 Jul 2026 — EDPB opens consultation on web scraping for generative AI The European Data Protection Board published draft Guidelines 03/2026 on web scraping in the context of generative AI, clarifying how the GDPR applies where personal data is collected from the internet at scale to develop or train models. The draft confirms the GDPR applies to mixed personal and non-personal datasets, works through controller/processor roles, purpose limitation and data minimisation, and treats legitimate interests as the usual lawful basis — subject to a three-part test weighing the scale of collection, the source, whether anti-scraping measures were in place, and whether narrower collection, synthetic or pseudonymised data would do. Transparency is not waived by scale: the Article 14(5)(b) disproportionate-effort exemption is not a blanket carve-out, and controllers must still publish detail on sources, purposes and how to exercise rights. There is no general exemption for special category data collected incidentally. Consultation runs to 30 October 2026. This is data protection law, not the AI Act — but it is where training-data practice is actually being set in the EU. EDPB — Guidelines 03/2026 on web scraping in the context of generative AI (public consultation) <https://www.edpb.europa.eu/public-consultations/guidelines-032026-on-web-scraping-in-the-context-of-generative-ai_en>

8 Jul 2026 — EDPB opens consultation on web scraping for generative AI The European Data Protection Board published draft Guidelines 03/2026 on web scraping in the context of generative AI, clarifying how the GDPR applies where personal data is collected from the internet at scale to develop or train models. The draft confirms the GDPR applies to mixed personal and non-personal datasets, works through controller/processor roles, purpose limitation and data minimisation, and treats legitimate interests as the usual lawful basis — subject to a three-part test weighing the scale of collection, the source, whether anti-scraping measures were in place, and whether narrower collection, synthetic or pseudonymised data would do. Transparency is not waived by scale: the Article 14(5)(b) disproportionate-effort exemption is not a blanket carve-out, and controllers must still publish detail on sources, purposes and how to exercise rights. There is no general exemption for special category data collected incidentally. Consultation runs to 30 October 2026. This is data protection law, not the AI Act — but it is where training-data practice is actually being set in the EU. EDPB — Guidelines 03/2026 on web scraping in the context of generative AI (public consultation) <https://www.edpb.europa.eu/public-consultations/guidelines-032026-on-web-scraping-in-the-context-of-generative-ai_en>