AI Regulation Tracker / Guidelines adopted

EDPB Adopts Guidelines 03/2026 on Web Scraping for Generative AI Training

Regulatory summary: On July 8, 2026, the European Data Protection Board adopted Guidelines 03/2026 on web scraping for generative AI, plus companion anonymisation guidelines. GDPR applies to scraped personal data even when publicly visible. The guidelines are open to public consultation until October 30, 2026.

Europe's data-protection regulators just told AI builders that "publicly available" is not a legal basis to scrape people's data.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years · Reviewed by The Leveraged Years Editorial Desk · Published July 9, 2026 · Last updated July 9, 2026

EDPB Adopts Guidelines 03/2026 on Web Scraping for Generative AI Training regulation briefing

The Leveraged Years AI Regulation Tracker

Key takeaways

The EDPB states plainly that GDPR governs web scraping whenever it touches personal data, that public visibility is not consent or a legal basis, and that special-category scraping is in principle prohibited absent both an Article 6 basis and an Article 9(2) exception.
AI and ML engineering teams, data-protection officers, privacy and compliance counsel, MarTech and data vendors, and any regulated firm building or procuring generative AI trained on web data.
Status: Adopted July 8, 2026 at the EDPB plenary in Brussels.
Inventory every scraped dataset feeding your models, attach an Article 6 basis and legitimate-interest assessment to each, and file consultation comments before October 30, 2026 if the guidance affects your pipeline.

Regulatory Briefing

Bindingness: EDPB guidelines, adopted, under consultation (interpretive guidance on existing GDPR obligations, not new legislation; final version follows consultation).
Scope: Controllers and processors that collect personal data from the open web to develop, train, fine-tune, or evaluate generative AI models, including foundation-model developers, downstream fine-tuners, and firms buying scraped datasets.
What Changed: The EDPB states plainly that GDPR governs web scraping whenever it touches personal data, that public visibility is not consent or a legal basis, and that special-category scraping is in principle prohibited absent both an Article 6 basis and an Article 9(2) exception.
Who This Affects: AI and ML engineering teams, data-protection officers, privacy and compliance counsel, MarTech and data vendors, and any regulated firm building or procuring generative AI trained on web data.
Current Status: Adopted July 8, 2026 at the EDPB plenary in Brussels; released as a draft final version for public consultation.
Effective Date: Guidance (interpretive; consultation to October 30, 2026); the underlying GDPR obligations are already in force.
Primary Source: https://www.edpb.europa.eu/news/edpb-sheds-light-on-anonymisation-and-web-scraping-for-generative-ai-and-adopts-final-version_en
Secondary Analysis: EDPB press release and the companion Guidelines 02/2026 on anonymisation, adopted at the same plenary.
Workflow Impact: Data-ingestion pipelines for AI training now require a documented legal basis, a legitimate-interest balancing test, source timestamping and validation, transparency measures, and a hard filter for special-category data before any training run.
Operational Next Step: Inventory every scraped dataset feeding your models, attach an Article 6 basis and legitimate-interest assessment to each, and file consultation comments before October 30, 2026 if the guidance affects your pipeline.
Last Verified: July 9, 2026

Date	Jurisdiction	Rule	Affected professionals	Status or effective date
2026-07-09	European Union	The EDPB states plainly that GDPR governs web scraping whenever it touches personal data, that public visibility is not consent or a legal basis, and that special-category scraping is in principle prohibited absent both an Article 6 basis and an Article 9(2) exception.	AI and ML engineering teams, data-protection officers, privacy and compliance counsel, MarTech and data vendors, and any regulated firm building or procuring generative AI trained on web data.	Adopted July 8, 2026 at the EDPB plenary in Brussels; released as a draft final version for public consultation.

Frequently Asked Questions

Are these EDPB guidelines legally binding right now?

They are interpretive guidelines, not new legislation, and they are still in draft-final form open for consultation until October 30, 2026. However, the GDPR obligations they interpret, on lawfulness, transparency, and accuracy, are already binding, so the practical expectations apply today.

Can we scrape publicly available data without consent?

Public visibility is not consent and not a legal basis. You still need a valid Article 6 basis, usually legitimate interest supported by a documented balancing test, and you must meet transparency and accuracy duties.

What happens if scraped data includes special-category information?

Processing special categories is in principle prohibited. You need both an Article 6 legal basis and an Article 9(2) exception, which mass scraping rarely satisfies, so treat broad special-category scraping as presumptively unlawful.

Does anonymising a dataset let us skip GDPR?

Only if re-identification is not reasonably possible by any likely means. Pseudonymised or weakly de-identified data is still personal data, so the companion Guidelines 02/2026 set a high bar before GDPR stops applying.

We buy scraped datasets rather than scraping ourselves. Are we covered?

No. Buying or using a scraped dataset is still processing personal data, so you inherit controller duties. You need to verify the legal basis, provenance, and special-category filtering of any dataset before feeding it to a model.