EDPB guidelines on 'web scraping' for Generative AI

European Data Protection Board (EDPB) guidelines highlight the challenges for AI developers in complying with data protection legislation when collecting data and processing data collected through ‘web scraping’.

A couple of key takeways from the guidelines:

• Compliance (and demonstrating compliance) is hard. In many contexts, it may not be feasible. Determining feasibility and ensuring compliance would require a thorough understanding of, for instance, the application context, the model lifeycle, and data protection across technical and legal dimensions.

• To the extent that an organisation deems ‘web scraping’ to be lawful in a given context, AI developers need to define, apply and document strict inclusion and exclusion criteria to limit any processing of personal data, whether intended or unintended, at each stage of the model lifecycle.

Read the EDPB Guidelines on web scraping for Generative AI at: https://www.edpb.europa.eu/system/files/2026-07/edpb_guidelines_2020603_webscraping_v1_en_0.pdf

Read an article from the IAPP about the guidelines at: https://iapp.org/news/a/thought-for-the-week-web-scraping-for-generative-ai-is-subject-to-the-gdpr

Read EDPB news article announcing adoption of the guidelines at: https://www.edpb.europa.eu/news/edpb-sheds-light-on-anonymisation-and-web-scraping-for-generative-ai-and-adopts-final-version_en