EDPB Guidelines 03/2026: Web Scraping for Generative AI
EDPB Guidelines 03/2026 (Draft v1.0 under consultation until 30 Oct 2026) regulate AI web scraping: strict legitimate interest assessment, compliance with Article 9 sensitive data prohibitions, and proactive transparency under Article 14.
1. Purpose, Scope & Context of Guidelines 03/2026
EDPB Guidelines 03/2026 (Version 1.0 adopted on 7 July 2026) apply to private entities collecting personal data from publicly accessible sources on the internet (web scraping) specifically for developing, training, fine-tuning, and evaluating generative artificial intelligence models.
2. Legal Principles & Consultation Focus Points
- Lawfulness of processing (Art. 6): Because obtaining prior consent is practically unfeasible in mass web scraping, developers generally rely on legitimate interest (Art. 6.1.f). The EDPB stresses that this basis requires demonstrating strict necessity and taking into account technical measures signaling opposition to web scraping (such as robots.txt, ai.txt or CAPTCHAs, although the robots.txt protocol does not in itself constitute valid consent).
- Special categories of data (Art. 9): The EDPB firmly emphasizes that the mere public availability of data on the internet does not suffice to consider it manifestly made public by the data subject within the meaning of Article 9(2)(e). Mass processing of scraped sensitive data without a valid exemption is strictly unlawful.
- Transparency & information to data subjects (Art. 14): In indirect data collection, the controller must in principle inform individuals. If the disproportionate effort exemption (Art. 14.5.b) is invoked, robust compensatory measures (clear public notice, easily accessible opt-out mechanisms) must be implemented.
- Data minimisation & Privacy by Design (Art. 25): Minimisation measures include filtering out non-relevant personal data and, where feasible post-collection, anonymising or pseudonymising data before the actual model training phase.
3. Doctrinal Status & Public Consultation Period
These guidelines represent a major European doctrinal milestone linking the GDPR and the European AI Act (Regulation (EU) 2024/1689). Digital ecosystem stakeholders are invited to provide input during the EDPB public consultation open until 30 October 2026.
Verified Official Sources
Web scraping pour l'entraînement de modèles d'IA générative, licéité (Art. 6), catégories particulières (Art. 9), transparence (Art. 14) et minimisation (version 1.0 adoptée le 7 juillet 2026, consultation publique ouverte jusqu'au 30 oct. 2026)
Consult official source →Traitement de données personnelles dans le cadre du développement de modèles d'IA, évaluation du risque de mémorisation/extraction, anonymisation des pondérations, intérêt légitime et mesures d'atténuation (Avis Art. 64 du CEPD)
Consult official source →Intérêt légitime (Art. 6.1.f) : un intérêt commercial licite n'est pas exclu en tant qu'intérêt légitime, sous réserve de la stricte nécessité du traitement et de la mise en balance avec les droits fondamentaux (ECLI:EU:C:2024:858)
Consult official source →Associated Operational Micro-Tools
Methodically assess the 6 legal grounds (contract, legal obligation, consent...) and frame your legitimate interests.
Check whether your project triggers mandatory DPIA requirements or meets the EDPB 9 high-risk criteria.
See Also in the Legal Framework
Article 6 GDPR: The Six Lawful Grounds for Lawful Processing
Legal analysis of Article 6 GDPR: the six alternative legal bases for lawfulness of processing, valid consent criteria, ...
CJUE C-621/22 KNLTB : Licéité de l'Intérêt Commercial sous l'Art. 6(1)(f)
Décision fondamentale de la CJUE du 4 octobre 2024 (ECLI:EU:C:2024:858) : un intérêt commercial licite n'est pas exclu e...
Article 35 RGPD : Critères et Méthodologie de l'AIPD (DPIA)
Cadre juridique de l'AIPD (Art. 35 RGPD) : cas obligatoires, critères WP248 de risque élevé, méthode d'évaluation et con...