EDPB adopts Guidelines 03/2026 on web scraping for generative AI (July 7/8) — "publicly available is not a legal basis"
At its plenary, the EDPB adopted draft Guidelines 03/2026 (Version 1.0): GDPR applies to scraping whenever personal data is collected/stored/organized/retrieved; legitimate interest (Art. 6(1)(f)) is the primary candidate basis but requires
On 2026-07-07, the verified AI news record added a significant litigation, labor & society development: At its plenary, the EDPB adopted draft Guidelines 03/2026 (Version 1.0): GDPR applies to scraping whenever personal data is collected/stored/organized/retrieved; legitimate interest (Art. 6(1)(f)) is the primary candidate basis but requires a three-part test; no blanket AI-training exemption; special-category data in principle prohibited absent Art. 9(2) exception (GC & Others C-136/17 reasoning for incidental collection); transparency via public notice where individual notice is impossible. Public consultation runs July 8 – October 30, 2026. (Adoption date stated as July 7 by some firm analyses, July 8 by EDPB's own release — minor discrepancy noted.)
Context
At its plenary, the EDPB adopted draft Guidelines 03/2026 (Version 1.0): GDPR applies to scraping whenever personal data is collected/stored/organized/retrieved; legitimate interest (Art. 6(1)(f)) is the primary candidate basis but requires a three-part test; no blanket AI-training exemption; special-category data in principle prohibited absent Art. 9(2) exception (GC & Others C-136/17 reasoning for incidental collection); transparency via public notice where individual notice is impossible. Public consultation runs July 8 – October 30, 2026. (Adoption date stated as July 7 by some firm analyses, July 8 by EDPB's own release — minor discrepancy noted.) Directly targets the training-data supply chain; will steer DPA enforcement and interacts with the AI Act GPAI copyright-policy duty. Deployers procuring third-party models face due-diligence duties.
What changed
At its plenary, the EDPB adopted draft Guidelines 03/2026 (Version 1.0): GDPR applies to scraping whenever personal data is collected/stored/organized/retrieved; legitimate interest (Art. 6(1)(f)) is the primary candidate basis but requires a three-part test; no blanket AI-training exemption; special-category data in principle prohibited absent Art. 9(2) exception (GC & Others C-136/17 reasoning for incidental collection); transparency via public notice where individual notice is impossible. Public consultation runs July 8 – October 30, 2026. (Adoption date stated as July 7 by some firm analyses, July 8 by EDPB's own release — minor discrepancy noted.) According to EDPB official release (primary); Alston & Bird; REVERA; Licentium; GamingTechLaw, the supporting record states: “The GDPR applies to web scraping when it includes personal data processing operations, such as collection, storage, organisation and retrieval." (EDPB)”.
Why it matters
Directly targets the training-data supply chain; will steer DPA enforcement and interacts with the AI Act GPAI copyright-policy duty. Deployers procuring third-party models face due-diligence duties. The item matters because legal exposure, labor decisions, and social impact increasingly determine how AI systems are deployed and governed.
Details
The research file records the item under “EDPB adopts Guidelines 03/2026 on web scraping for generative AI (July 7/8) — "publicly available is not a legal basis"” with source timing of 2026-07-07/08; consultation to 2026-10-30. The captured research confidence note is: High | Status: Confirmed news (guidance adopted; consultation open). Additional captured source links are listed below so readers can inspect the evidence trail rather than rely on a single summary. Directly targets the training-data supply chain; will steer DPA enforcement and interacts with the AI Act GPAI copyright-policy duty. Deployers procuring third-party models face due-diligence duties.
Limitations and caveats
The research file did not identify a blocking caveat, but vendor-supplied claims should still be read as company statements unless independently confirmed.
Sources
Update note: Last reviewed 2026-07-22. Next checkpoint: monitor official channels and the linked source record.
Sources
Drafted with AI assistance from source briefs; reviewed for citation completeness and label accuracy.