Guidelines 03/2026 on web scraping in the context of generative AI
These guidelines provide detailed direction on the application of the GDPR to web scraping activities conducted by private entities for the purpose of training generative AI models. They examine key compliance challenges, including defining controller and processor roles, satisfying data protection principles like transparency, data minimisation, and accuracy, establishing lawful bases such as legitimate interest, and handling special categories of personal data. The document outlines technical and organisational measures that controllers should implement before, during, and after collection to mitigate risks to data subjects' rights and freedoms.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
Private entities, AI developers, and legal compliance officers should read this to ensure their web scraping practices for generative AI comply with European data protection law.
What the document contains
The document addresses the legal and technical implications of web scraping publicly available internet sources for the purpose of training or fine-tuning generative AI models. It covers controller and processor qualifications, GDPR data protection principles, identifying lawful bases under Article 6, and managing special categories of personal data under Article 9.
The guidelines do not cover web scraping performed by public authorities, non-private entities, data brokers whose primary intention is not AI training, or the internal processing of an organisation's own pre-existing employee or customer data.
- The GDPR applies to web scraping whenever personal data processing operations—such as extraction, cleaning, and storage—are involved in creating generative AI training datasets.
- Controllers must carefully assess their roles and responsibilities as single controllers, joint controllers, or when engaging external entities as processors for scraping tasks.
- While transparency is required, individual notice may be excused under Article 14(5)(b) GDPR if impossible or requiring disproportionate effort, provided appropriate public notices and safeguards are in place.
- Data minimisation requires proactive measures before scraping, including precise collection criteria, exclusion of sites opposing scraping, and filtering out unnecessary personal data categories.
- Private entities often rely on legitimate interest under Article 6(1)(f) GDPR, which requires fulfilling three cumulative conditions: a legitimate interest, necessity, and a balancing test against data subjects' rights.
- The incidental collection of special categories of personal data requires strict adherence to Article 9 GDPR, though search-engine-related jurisprudence (GC & Others) can inform technical and organisational limits within a controller's capabilities.
1 Introduction and scope 2 Definition of web scraping 3 Web scraping and the GDPR 3.1 General observations 3.2 Guidance on specific provisions in the GDPR 3.2.1 Controller/joint controllers/processor 3.2.2 Principles relating to processing of personal data 3.2.3 Legal basis for the processing of personal data 3.2.4 Special categories of personal data
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Accountability
4/5Clear responsibility for AI outcomes
It is thus not obvious how to meet the principle of accountability laid down in Article 5(2) GDPR when processing such data sets for AI development . Nonetheless, compliance with regard to Article 5(2) GDPR must be met by the controller
3.1 General observations
screening score · 2026-10-23
Fairness
1/5Non-discrimination and equitable treatment
Personal data should be processed lawfully, fairly and in a transparent manner in relation to the data subject
3.2.2 Principles relating to processing of personal data
screening score · 2026-10-23
Human Dignity
2/5Respect for the inherent worth of persons
The generation of deep-fakes (pictures, videos, speech) also adds to the possible impact on data subjects’ interests, rights and freedoms, as well as possibly on the right to dignity of the person concerned
3.2.3 Legal basis for the processing of personal data
screening score · 2026-10-23
Human Oversight
1/5Humans remain in control of consequential decisions
and retaining control over their own personal data
3.2.3 Legal basis for the processing of personal data
screening score · 2026-10-23
Privacy
5/5Protection of personal data and private life
These guidelines aim to clarify the legal and technical implications of web scraping for generative artificial intelligence (AI) development under the GDPR .
1 Introduction and scope
screening score · 2026-10-23
Transparency
4/5Openness about how AI systems work and are used
For the latter, t his includes the obligation to inform the data subject about the processing of their personal data.
Executive summary
screening score · 2026-10-23
Enforcement
1/5Consequences and compliance mechanisms with real force
Compliance with certain GDPR requirements can be challenging when web scraping is used to collect personal data
3.1 General observations
screening score · 2026-10-23
Impact Assessment
4/5Required assessment of an AI system's risks/impacts before or during use
the controller should carry out a case-by case analysis of whether the reasoning of the Court’s ruling can be applied to a specific processing activity
Executive summary
screening score · 2026-10-23