30 October 2026: EDPB draft guidelines on AI web scraping close for consultation

30 October 2026

On 30 October 2026, the consultation period closes for the EDPB Guidelines 03/2026 on web scraping in the context of generative AI. These guidelines will bind developers and deployers training models on scraped web data, and publishers whose sites are scraped. Organisations must analyse their data processing operations against the draft guidelines and submit feedback before the deadline.

The EDPB Guidelines 03/2026 address the application of the GDPR to web scraping activities, particularly when data is used for training generative AI models. Developers and deployers of AI models must establish a lawful basis for processing personal data obtained through web scraping, considering the principles of purpose limitation and data minimisation. This includes conducting thorough DPIAs where high risk processing is identified, and ensuring transparency towards data subjects regarding the collection and use of their data.

Publishers of websites, as data controllers, need to understand their rights and obligations when their sites are scraped. The guidelines will clarify how to assess the legality of scraping activities and what measures can be taken to protect personal data. Both parties should review the draft guidelines to understand the EDPB's position on legitimate interests, consent, and the responsibilities of controllers and processors in the web scraping ecosystem. Evidence of this preparatory work, such as internal legal analyses, updated records of processing activities, and impact assessments, would be expected by supervisory authorities.

Dates like this one are missed far more often than obligations are misread, because the work that has to precede them is owned by teams who never see the deadline.