Guidelines 03/2026 on web scraping in the context of generative AI
These guidelines by the European Data Protection Board clarify the legal and technical implications of web scraping for the training and development of generative AI models under the GDPR. They address roles such as controllers and processors, and provide guidance on complying with core GDPR principles including lawfulness, purpose limitation, transparency, data minimisation, and accuracy. Additionally, the document examines legitimate interest as a legal basis and discusses requirements for handling special categories of personal data.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
Private entities, AI developers, and legal practitioners should read this to understand how to comply with EU data protection law when web scraping for generative AI training.
What the document contains
The document covers the application of the GDPR to web scraping for generative AI training by private entities. It addresses actor classifications, compliance with data processing principles, the use of legitimate interest as a legal basis, and handling special categories of personal data.
The document does not address web scraping conducted by non-private entities or data brokers whose primary intention is not to train AI models.
- The GDPR applies to web scraping activities by private entities when personal data processing operations are involved.
- Organizations must assess their roles as controllers, joint controllers, or processors on a case-by-case basis.
- To satisfy transparency obligations when direct notice is impossible or requires disproportionate effort, controllers must make privacy information publicly available.
- Data minimisation measures such as pre-collection filtering, syntax-based filtering, and synthetic data replacement should be implemented.
- Legitimate interest under Article 6(1)(f) GDPR is frequently relied upon but requires fulfilling three cumulative conditions and passing a balancing test.
1 Introduction and scope 2 Definition of web scraping 3 Web scraping and the GDPR 3.1 General observations 3.2 Guidance on specific provisions in the GDPR 3.2.1 Controller /joint controllers /processor 3.2.2 Principles relating to processing of personal data 3.2.3 Legal basis for the processing of personal data 3.2.4 Special categories of personal data
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Accountability
4/5Clear responsibility for AI outcomes
It is thus not obvious how to meet the principle of accountability laid down in Article 5(2) GDPR when processing such data sets for AI development . Nonetheless, compliance with regard to Article 5(2) GDPR must be met by the controller
3.1 General observations
screening score · 2026-10-23
Fairness
2/5Non-discrimination and equitable treatment
individuals who might be subject to abuse, prejudice or even physical harm if information was released publicly
3.2.3 Legal basis for the processing of personal data
screening score · 2026-10-23
Human Dignity
3/5Respect for the inherent worth of persons
The generation of deep-fakes (pictures, videos, speech) also adds to the possible impact on data subjects’ interests, rights and freedoms, as well as possibly on the right to dignity of the person concerned.
3.2.3 Legal basis for the processing of personal data
screening score · 2026-10-23
Human Oversight
1/5Humans remain in control of consequential decisions
aim to prohibit access to pages by robots
3.2.2 Principles relating to processing of personal data
screening score · 2026-10-23
Privacy
5/5Protection of personal data and private life
The GDPR applies to web scraping when it includes personal data processing operations, such as collection, storage, organisation and retrieval.
Executive summary
screening score · 2026-10-23
Transparency
4/5Openness about how AI systems work and are used
One appropriate measure that controllers must always take, as specified in Article 14( 5)(b), is to make the information publicly available.
3.2.2 Principles relating to processing of personal data
screening score · 2026-10-23
Enforcement
3/5Consequences and compliance mechanisms with real force
Compliance with certain GDPR requirements can be challenging when web scraping is used to collect personal data
Executive summary
screening score · 2026-10-23
Impact Assessment
4/5Required assessment of an AI system's risks/impacts before or during use
Where a controller seeks to rely on the exception in Article 14(5)(b) GDPR, it should assess the effort involved for the controller to provide the information to the data subject against the impact and effects on the data subject if they were not provided with the information.
3.2.2 Principles relating to processing of personal data
screening score · 2026-10-23