EDPB Guidelines 03/2026 on web scraping for generative AI
The European Data Protection Board adopted guidelines clarifying how GDPR applies to web scraping for generative-AI training and fine-tuning. The guidance treats scraping as large-scale automated extraction that often occurs without individuals’ awareness, says GDPR applies when personal data are collected, stored, organized, or retrieved, and emphasizes purpose limitation, transparency, accuracy, source reliability, timestamps, validation, data minimization, and special-category-data limits.
The European Data Protection Board adopted guidelines clarifying how GDPR applies to web scraping for generative-AI training and fine-tuning.
Why it matters
The key value for understanding AI's impact is that EU governance is moving away from a vague “public web data” debate toward auditable data-lifecycle controls, legal-basis analysis, and no general exemption for sensitive personal data.
Primary trail
Go to the source
Read the evidence behind this analysis. External links open in a new tab.