EDPB clarifies GDPR rules for web scraping used to train generative AI

MTNOTABLEGuidanceData protectionTraining data

What changed

The EDPB issued guidelines clarifying GDPR compliance requirements for web scraping in generative AI contexts, addressing legal basis and the conditions for processing special-category data.

Who this touches

AI providers and deployers that scrape web data to build or train generative AI systems.

Why it matters

Web scraping often happens without individuals' awareness and can touch special-category data, so the legal basis a provider relies on now has a documented reference point.

Suggested next step — and why

Providers building or sourcing training datasets from scraped web data may want counsel to review the guidelines against current data-sourcing practices.

The clock

No new deadline stated; the guidelines are now in effect as interpretive guidance.

Source: Primary source on file — read in the original, not from coverage.

Permanent record: this page is public forever. "When did we know?" always has a URL.

Curated nightly by Dr. Ivan Del Valle — AI governance architect, editor of The Compact. Disagree with a reading? Write ivan.delvalle@rsit.ai — every message is read, most are answered. Corrections are published, not buried. · Today's brief · Method · Reporting free forever; the desk is sustained by its data plans.