Summary

• The EDPB has adopted guidelines on anonymisation and web scraping in the context of generative AI.
• The guidance addresses GDPR application, accuracy, data minimisation, lawful basis, and special category data.
• AI developers face a more concrete European compliance test for training data collection and model governance.

The European Data Protection Board has adopted new guidelines on anonymisation and web scraping for generative AI, giving developers, platforms, publishers, and enterprise customers a clearer view of how European privacy rules apply when online material is collected for model development.

The guidance is not a ban on scraping, nor does it treat all AI training data as legally identical. It brings the debate back to the mechanics of GDPR compliance: whether personal data is processed, what purpose the controller is pursuing, how accuracy and minimisation are handled, whether legitimate interest can be relied on, and what safeguards are needed when sensitive categories of data may be collected.

The EDPB says GDPR applies to web scraping where it involves personal data processing operations such as collection, storage, organisation, and retrieval. Controllers should pay particular attention to purpose limitation and transparency, while the Board recognises that informing individuals personally may not always be possible or may require disproportionate effort depending on the processing design.

For AI developers, that is a more practical intervention than a broad political argument about scraping. The Board recommends scraping only from reliable sources, recording timestamps, and validating data before using it in AI training to support compliance with the accuracy principle. It also points to data minimisation measures and gives further clarification on legitimate interest in the specific context of AI training.

The special category data point may prove especially sensitive. The EDPB recalls that processing such data is generally prohibited unless both a lawful basis under Article 6 of the GDPR and an exception under Article 9 apply. In real world scraping, where datasets can unintentionally include health, political, religious, biometric, sexual orientation, or other sensitive information, that warning raises the compliance bar for indiscriminate collection.

The guidance arrives as AI companies, data brokers, publishers, rights holders, regulators, and enterprise buyers are still trying to define the boundaries of lawful training data practice. Copyright disputes have attracted much of the public attention, but European data protection law adds a separate layer of risk where the underlying material contains personal data. A dataset may be publicly accessible and still not be frictionless from a GDPR perspective.

Enterprise customers also have a stake in the outcome. Organisations using third party AI tools increasingly need assurances about data provenance, training practices, retention, model outputs, and downstream legal exposure. Procurement teams are likely to ask more direct questions about whether vendors can evidence their scraping safeguards, particularly where AI systems are used in regulated sectors or in workflows that affect individuals.

The guidance reinforces the difference between anonymisation as a technical claim and anonymisation as a legal threshold. European privacy law has long treated true anonymisation as difficult because data that can reasonably be reidentified remains within scope. For AI developers, data handling, deduplication, filtering, access control, model evaluation, and documentation become part of compliance rather than engineering hygiene.

Uncertainty remains around foundation models, open source datasets, search indexes, downstream fine tuning, and the extent to which different AI development stages create different obligations. The EDPB will not settle every argument, but it gives regulators and market participants a firmer basis for assessing whether AI scraping practices are controlled or merely opportunistic.

The Board’s intervention points towards a more evidence heavy phase of AI compliance in Europe. Developers will need to show not only that their systems perform, but that the data pipeline behind them can withstand scrutiny. In a market where AI adoption is moving into finance, healthcare, HR, public services, and professional workflows, that evidential burden is becoming part of the product.