EDPB Guidelines 03/2026: Web Scraping in the Context of Generative AI

We welcome the EDPB’s Guidelines 03/2026 on web scraping in the context of generative AI. The Guidelines provide important clarification on the application of the GDPR to the collection and further processing of personal data obtained from publicly accessible sources for the development and training of generative AI models.

We particularly appreciate the EDPB’s efforts to address the responsibilities of the different organisations involved in the web-scraping and AI-development chain, as well as the safeguards required throughout the data-processing lifecycle. At the same time, we would suggest that the Guidelines further clarify certain aspects of the relationship between web scraping, the nature of AI model training, and the GDPR concept of personal data. Additional guidance would be helpful regarding the distinction between the incidental presence of personal data in training material and processing that enables the identification, targeting, profiling, or individual treatment of data subjects.

We also suggest that the Guidelines take account of the practical and proportionality-related challenges associated with applying certain obligations to large-scale, automated AI-training processes.