Web scraping for AI training is possible, subject to specific conditions. That is the key message of the European Data Protection Board’s (EDPB) draft Guidelines 03/2026, published on 7 July 2026 and open for consultation until 30 October 2026. Once adopted, they will serve as a benchmark for assessing online data collection practices.
Are you concerned?
- Do you develop a general-purpose AI model or a generative model and collect web content at scale?
- Are you a scraping service provider or dataset supplier extracting data on behalf of your clients?
- Do you reuse an already-scraped dataset to train your AI system?
- Do you conduct monitoring, aggregation, comparison, marketing or recruitment activities using publicly available data?
You are concerned, but do not know where to start to achieve compliance?
What the Web Scraping and GDPR Guide Covers
Written by Dastra and Vigo Avocats for DPOs, legal counsel, CISOs, AI leads and project managers, this guide covers:
- the four stages of scraping, and why compliance starts with the very first one;
- the GDPR principles as applied to large-scale scraping: data minimisation, accuracy and transparency;
- informing data subjects: when you may be exempt from providing individual notice, and what you must publish in return;
- legitimate interest for AI training: the three requirements and safeguards that tip the balance;
- an action checklist by role: DPOs, CISOs, AI leads and senior management.
Once data has been incorporated into a model, it is not easily removed. It is better to make the right decisions before the first crawl.
👉 [Download the Web Scraping and GDPR Guide]