The Guidelines 03/2026 on web scraping in the context of generative AI, adopted by the European Data Protection Board “EDPB” for public consultation on 7 July 2026, are notable not only for what they require but for what they acknowledge. The document is unusually candid about three limitations: an epistemic one (the controller may not always know what it has collected), a technical one (what a model has learned cannot, today, be easily unlearned), and an institutional one (some of the assessments woven into the GDPR analysis sit, at least in part, with other authorities and courts). These acknowledgements are welcome, and they distinguish the text from more declaratory guidance. The tension is that the requirements built on top of them are not always adjusted accordingly, and that gap, between what the EDPB admits and what it nonetheless requires, is where the most interesting questions of the consultation lie.
Briefly, the Guidelines cover scraping performed by private entities, whether carried out in-house, commissioned from a third party or effected through the acquisition of pre-scraped datasets. They work through the familiar sequence: allocation of controller and processor roles, the core principles of Article 5 GDPR (purpose limitation, transparency, minimization, accuracy), the choice of legal basis, with legitimate interest under Article 6(1)(f) GDPR treated as the realistic candidate and consent all but discarded, and the treatment of special categories of data incidentally swept up in the collection, for which the EDPB adapts the CJEU’s GC & Others framework. Little of this structure will surprise anyone who has followed the Board’s recent work on AI. What rewards attention is how each of these familiar steps is made to function once the three limitations above enter the analysis.
I. The epistemic point: obligations premised on knowledge the controller may not have
The GDPR’s accountability architecture presupposes a controller who knows its processing: what it collects, from whom, and why. The Guidelines concede at the outset that untargeted crawling defeats that presupposition, since the controller may hold personal data it cannot inventory. Yet the obligations that follow are written for the controller the GDPR imagines, not for the one the EDPB has just described: precise collection criteria, exclusion of certain sources, category filters, all to be applied before a collection whose contents, on the document’s own account, can only be known afterwards. The problem is conceptual rather than one of drafting: the Guidelines restate obligations that assume knowledge, instead of explaining what accountability should look like when that knowledge is genuinely unavailable, which is arguably the question this technology poses most urgently.
The transparency analysis repeats the pattern at a smaller scale. The EDPB reads the “disproportionate effort” exception of Article 14(5)(b) GDPR narrowly, reserving it essentially for the purposes listed in Recital 62 GDPR (archiving, research and statistics), which commercial model training does not serve. What remains as a mandatory measure is a notice on the controller’s website: information addressed to everyone and, in practice, read by no one. The risk is that transparency becomes a formality precisely where informing individuals directly is least achievable. A fuller treatment would ask what transparency can still achieve when individual notification fails structurally, instead of keeping the model intact while its practical content shrinks.
II. The technical point: mitigation is not the same as remediation
The Guidelines accept that, at the current state of the art, personal data cannot really be deleted from a trained model. That admission matters more than the document allows. Under the Article 6(1)(f) GDPR balancing test, mitigating measures can tip the balance in the controller’s favour because they reduce the interference with individuals’ rights. Output filters and prompt restrictions do not reduce that interference: the data remains in the model’s weights; the measures only prevent it from showing. A balancing test satisfied by measures of this kind ends up weighing the processing against the controller’s effort rather than against its actual impact on individuals, which is not the same exercise.
The Guidelines also extend the CJEU’s GC & Others (C-136/17) case-law to the special categories of data that scraping inevitably picks up. In that judgment, the Court allowed search engines a degree of flexibility under Article 9 GDPR for a specific reason: a search engine can always undo the harm for a given individual, because de-indexing a result removes it for that person, on request and verifiably. A trained AI model offers nothing comparable. Once personal data has been absorbed into the model, it cannot be removed for one individual; the controller can only filter what the model outputs, a measure whose limits the Guidelines themselves acknowledge. The flexibility is therefore borrowed without the feature that justified it, and the analogy may not travel as well as the EDPB assumes.
III. The institutional point: third-party rights and the limits of supervisory competence
Example 7 makes a favorable balancing test conditional, among other things, on excluding copyright-protected content and respecting text-and-data-mining opt-outs under Article 4(3) of Directive (EU) 2019/790. The instinct is understandable: an interest pursued through collection that disregards third-party rights, including the sui generis database right of the scraped sources, sits uneasily with the notion of a “lawful” interest. The difficulty is where the EDPB has placed the assessment. In principle, supervisory authorities cannot decide whether a private right has been infringed between the scraper and the website operator; that belongs to the civil courts. Nor do they hold the evidence that such a decision would require: licenses, correspondence between the parties, proof of a substantial investment in the database and of a substantial taking from it. And where national courts have dealt with screen scraping, the operator’s unilateral opposition has rarely decided the matter by itself: outcomes have turned on whether a contract was actually concluded and whether the source qualified for database protection in the first place, precisely the kind of fact-intensive questions a supervisory authority is, in principle, not equipped to resolve. For general-purpose AI models, moreover, the supervision of these opt-outs has been expressly assigned to the AI Office under Article 53(1)(c) of the AI Act. By bringing all of this into Article 6(1)(f) GDPR without saying who assesses it, on what evidence, and where their competence ends, the Guidelines risk turning the balancing test into a gateway for every legal regime that touches scraping: an understandable ambition in terms of coherence, but one that sits uneasily with the allocation of competences the EU legislator has actually made.
IV. What the Guidelines actually establish
Put these three points together and the standard that actually emerges becomes clear. A controller cannot know in advance everything it collects; cannot undo afterwards what the model has learned; and cannot obtain from any supervisory authority a ruling on the third-party rights questions the test now contains. What such a controller can do is document: criteria defined, sources excluded, filters applied, requests honoured, outputs monitored. Compliance, in substance, comes closer to a defensible record of diligence than to a demonstrable reduction of interference. There is nothing wrong with that; the law often deals with uncertainty through process obligations. But a process standard should be called by its name, because the label matters in practice: it determines what an authority can sanction, what a claimant must prove, and whether developers are encouraged to invest in documentation systems or in genuinely less intrusive collection. Perhaps the most valuable outcome of this consultation would not be another safeguard added to the list, but greater clarity about the kind of standard the EDPB is, in substance, laying down.
The Guidelines are open for public consultation and may change before final adoption.
Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only, and is not intended to constitute or be relied upon as legal advice.
Stay Ahead on Consumer Privacy News
Not a subscriber yet? Subscribe here to be among the first to receive timely updates on the fast-moving world of data privacy, security, and innovation—delivered straight to your inbox.
Looking for deeper insights and expert analysis? You can also subscribe here to our privacy attorneys’ marketing communications for thought leadership and rich content when you need a more comprehensive perspective.