GDPR17 Jul 2026Art. 6, Art. 9(2)
On 8 July 2026 the EDPB published guidance on when data counts as anonymous and how the GDPR applies to web scraping used to train generative AI. Data is anonymous only if individuals cannot be singled out, linked across records, or inferred - and that assessment can differ per recipient. Scraping personal data must respect purpose limitation, transparency, accuracy and data minimisation, and special-category data still needs both an Article 6 lawful basis and an Article 9(2) exception. The anonymisation and web-scraping guidelines are open for public consultation until 30 October 2026 and may still change; the accompanying blockchain guidelines were adopted in final form.
What to do: If you train or fine-tune generative AI on scraped or web-sourced data, document the Article 6 lawful basis and confirm no special-category data is used without an Article 9(2) exception. Re-test any data you treat as anonymised against the singling-out, linkability and inference criteria. Keep records of purpose limitation, source reliability (timestamps), accuracy validation and data-minimisation measures for your scraping pipeline.
Source: EDPB ↗