EDPB Draft Guidelines on Anonymisation and AI Web Scraping Close for Comment 30 October
The European Data Protection Board's draft guidelines on anonymisation and on web scraping for generative AI are open for public consultation until 30 October 2026 (10 days). Published 8 July 2026, they set the EU regulators' working test for when data is truly anonymous and when scraping personal data for AI training is lawful.
Why It Matters
Both drafts go to the heart of AI and analytics programmes. The anonymisation draft says data is anonymous only if it does not relate to an identified or identifiable person, and applies three tests: no record isolation, no linkage, no inference. If any test fails, the data needs further analysis and may remain personal data under the GDPR.
The web-scraping draft confirms the GDPR applies when scraping involves personal data, clarifies when legitimate interest can serve as the legal basis, and states that special-category data needs both an Article 6 basis and an Article 9(2) exception. The Board says there is no general exemption from Article 9. It follows Italy's IQVIA decision earlier this month, where persistent patient codes defeated an anonymity claim.
Consultation comments are the only formal chance to shape the final text. The blockchain guidelines adopted in the same July package are already final.
Action Items
Test your "anonymised" datasets — run the isolation, linkage and inference tests against any dataset you treat as anonymous, before 30 October if you plan to comment.
Map your AI training sources — list scraped or third-party web data used for model training and the legal basis you rely on for each.
Decide whether to file — if the drafts affect your products, submit comments through the EDPB consultation pages by 30 October.
Also Today
Cologne court curbs Snapchat's AI ad targeting. The Landgericht Köln (case 33 O 120/24, judgment of 17 September, made public 15 October) upheld a consumer-association claim against Snap Group Limited. It bars use of personal data for advertising without a sufficient legal basis, including sensitive data of children collected through the "My AI" chatbot, and bars consent by default settings. It also found alcohol and gambling ads pre-selected in minors' profiles unlawful. The judgment is not final. Action: check that no ad-consent or ad-topic setting in your AI features is pre-ticked. Source: vzbv
India's consent-manager rules start 13 November (24 days). The consent-manager provisions of the DPDP Rules 2025 (Rule 4) take effect one year after the Rules' November 2025 notification. Action: map where your consent flows would integrate with registered consent managers and update data-principal notices.
Deadline Alert
29 Oct: Italy's Garante email tracking-pixel rules become enforceable. 30 Oct: EDPB consultations close. 13 Nov: India consent-manager provisions; EDPB fining guidelines 04/2026 consultation closes.
Get the full analysis. Pro subscribers receive the complete deep dive, all 5 action items, source documents, and jurisdiction-specific compliance checklists.
Subscribe to Pro to read the rest.
Become a paying subscriber of Pro to get access to this post and other subscriber-only content.
UpgradeA subscription gets you:
- Deep dives of each updated regulation
- Source verification documents
- Extended jurisdiction-specific analysis
- Compliance deadline tracker
- Regulation crosswalk