EDPB clarifies GDPR rules for web scraping in generative AI

EUNOTABLEGuidanceData protectionTraining data

What changed

The EDPB issued guidelines clarifying GDPR compliance requirements for web scraping used in generative AI, covering the legal basis for scraping and the conditions for processing special-category data.

Who this touches

AI providers and deployers that scrape web data to build or run generative AI systems, and the individuals whose personal data is collected.

Why it matters

Scraping for training data now has a Board-level reference point on legal basis and special-category handling, sharpening what GDPR compliance is meant to look like in this specific practice.

Suggested next step — and why

Providers sourcing or licensing scraped training datasets may want to review the guidelines against their data-sourcing pipeline with counsel.

The clock

No new deadline stated; the guidelines stand as current interpretive guidance.

Source: Primary source on file — read in the original, not from coverage.

Permanent record: this page is public forever. "When did we know?" always has a URL.

Curated nightly by Dr. Ivan Del Valle — AI governance architect, editor of The Compact. Disagree with a reading? Write ivan.delvalle@rsit.ai — every message is read, most are answered. Corrections are published, not buried. · Today's brief · Method · Reporting free forever; the desk is sustained by its data plans.