Understanding the EDPB’s Guidelines on Web Scraping for Generative AI
On July 7, 2026, the European Data Protection Board (EDPB) made a significant move by publishing draft guidelines aimed at navigating the complex terrain of web scraping in the context of generative AI. As organizations increasingly rely on data sourced from the internet to train their AI systems, these guidelines serve as crucial guidance under the General Data Protection Regulation (GDPR). They are particularly relevant for any entity involved in data scraping or those that utilize datasets scraped by third parties.
Who Do the Guidelines Affect?
The EDPB’s guidelines apply to two primary groups:
- Organizations Scraping Data: This includes those directly extracting data from the internet—be it through automated tools or human effort—to develop generative AI models.
- Entities Using Pre-Scraped Data: These include companies that purchase datasets from third parties, such as data brokers, who have carried out scraping activities.
The guidelines emphasize the responsibilities of data controllers and provide a framework for understanding the intricate relationships between data scrapers and AI developers.
Six Key Areas of GDPR Compliance
The guidelines spotlight six key areas that organizations must consider to remain compliant with GDPR. Here’s an overview of each aspect:
1. Data Protection Roles
The EDPB underscores the importance of clearly defining roles within the web scraping ecosystem. The allocation of these roles can vary based on specific circumstances:
- Processor: When a scraper follows documented instructions from an AI developer without exercising independent judgment, the AI developer holds the role of controller.
- Joint Controller: If both parties work together to determine data collection criteria, they share responsibility.
- Separate Controllers: When an AI developer uses a pre-scraped dataset, each organization is accountable for its individual processing tasks.
Practical takeaway: Organizations should assess their role in the data scraping ecosystem to understand their obligations fully.
2. Legal Basis for Data Processing
The EDPB highlights two key legal bases under the GDPR for processing personal data:
- Consent: Generally, obtaining consent for large-scale scraping is impractical, as data subjects are often unaware their data is being collected.
- Legitimate Interest: This approach requires a more detailed analysis involving a documented balancing test. Organizations must identify a legitimate interest, demonstrate necessity, and ensure that their interests do not override those of the data subjects.
Practical takeaway: Organizations should meticulously document their balancing tests and implement measures to minimize privacy impacts.
3. Data Minimization
Data minimization is a cornerstone of GDPR that dictates personal data must be adequate, relevant, and confined to what is necessary. The EDPB states that compliance must be maintained throughout the entire scraping process.
Practical takeaway: Build data minimization principles into the scraping architecture, applying filters to exclude sensitive information and limiting the types of data captured.
4. Transparency Obligations
Transparency is vital for maintaining trust. The EDPB acknowledges that identifying and notifying individual data subjects at scale can be impractical. However, organizations can rely on the disproportionate effort exemption, requiring thorough justification.
Practical takeaway: If using the disproportionate effort exemption, ensure public accessibility of privacy notices. These should clearly outline the data collection process and safeguard measures.
5. Accuracy of Data
The accuracy of scraped data presents unique challenges, as it may be outdated or come from unreliable sources. Compliance with GDPR’s accuracy obligations is important to minimize the risk of generating incorrect or harmful outputs.
Practical takeaway: Implement measures like timestamping data, relying on credible sources, and validating data before it enters training pipelines.
6. Special Category Personal Data (SPD)
Organizations must take precautions to avoid collecting SPD. If it becomes unavoidable, the EDPB advises a condition-based assessment under Article 9(2) of the GDPR. A nuanced understanding is called for when it comes to incidental collection, drawing parallels to search engine operations.
Practical takeaway: Document and implement robust technical and organizational measures to manage the lifecycle of sensitive data.
The Path Forward
The EDPB’s draft guidelines mark an important step in aligning AI development with data protection principles under the GDPR. While they do not completely resolve the tension between large-scale AI training and individual data protections, they clarify the compliance landscape, offering actionable steps for organizations involved in web scraping.
As the EDPB opens a feedback consultation on these guidelines until October 30, 2026, it’s clear that the responsibility remains firmly on the shoulders of data controllers, reinforcing that publicly available data is not synonymous with freely usable data.