The Great Shift: AI, the Web and Our Personal Data

A Silent Acceleration

Generative tools have made text, image, voice and video production nearly instantaneous. No robust method can establish one precise worldwide percentage of AI-generated web content, especially when human and machine contributions are intertwined.

The relevant question is therefore not only how much content is synthetic, but which personal data was used, who is responsible and how individuals can exercise control.

When the Web Becomes Training Material

Publicly accessible information may still be personal data. Web scraping is not prohibited as such, but purpose, lawful basis, necessity, reasonable expectations, sensitive data and safeguards must be assessed.

A robots.txt file is a relevant technical signal, not a universal GDPR objection mechanism. Its absence is not consent. Effective governance combines exclusions, filtering, provenance records, information and accessible rights channels.

The Difficult Right to Be Forgotten

Deleting the source may not remove copies, indexes or learned effects. Yet it is equally inaccurate to claim that every item is irreversibly dissolved into model weights. Memorisation, extraction and identifiability require a case-specific assessment.

Article 17 does not disappear after training. Depending on the circumstances, an effective response may concern source datasets, retrieval indexes, outputs, filters, unlearning or retraining. Privacy by design should anticipate these requests.

Collective Risks Without an Apocalypse Narrative

Research shows that indiscriminate recursive training on model-generated data can erode diversity and rare cases. This is a conditional scientific risk, not proof that every model must collapse.

Automation can also dilute responsibility and homogenise expression. Data quality, fairness, transparency, profiling risks and the ability to identify the source become central governance concerns.

GDPR and the AI Act

The AI Act and the GDPR are complementary. An AI label does not legalise unlawful data collection, and a GDPR lawful basis does not satisfy every AI Act obligation.

Content Credentials can provide verifiable provenance, but do not certify that a statement is true or exclusively human. Trust requires provenance, accountable actors, effective rights and careful design.

• Define purposes and responsibilities before collection;
• Document lawful basis, necessity, exclusions and retention;
• Assess memorisation, extraction and high-risk impacts;
• Provide information and workable access, objection and erasure channels.

Verified Official Sources

See Also in the Legal Framework