On July 8, 2026, the European Data Protection Board (EDPB) adopted the "Guidance 03/2026 on Web Scraping in the Context of Generative AI" during a plenary session in Brussels — the first pan-European document that directly addresses a question that has loomed over the entire data collection industry for years: does scraping fall under GDPR if the data is publicly available? The EDPB's answer is clear and, for many, unwelcome: yes, it does — and "public" no longer means "free to take." The document is open for public consultation until October 30, 2026, but even now it sets the framework by which European regulators will assess any collection of personal data.
What Exactly Did the EDPB Decide
The main thesis of the guidance is simple. GDPR applies whenever web scraping involves personal data — that is, any operations related to collecting, storing, organizing, and extracting information that can directly or indirectly identify an individual. And — crucially — it does not matter whether this information was publicly visible. The EDPB explicitly rejects the popular industry assumption that "if data is in a public profile, it is outside regulation." Organizations should not expect European authorities to consider such data exempt from GDPR.
This turns the usual logic on its head. For many years, data collectors relied on the combination of "publicly available + residential proxy = technically possible, legally tolerable." The EDPB separates two questions that were previously conflated: technical availability of data and legal basis for processing are not the same thing. The former is addressed by infrastructure. The latter is governed solely by law.
Test for "Legitimate Interest": No Longer Default
Most personal data scrapers justify their processing by citing "legitimate interest" (legitimate interest, Art. 6(1)(f) GDPR). The EDPB confirms that this basis is generally applicable to scraping for AI training, but it imposes strict conditions. There can be no "wholesale" assessment — the test must be conducted for each specific case and consists of three steps:
- Real Interest. A specific, legitimate, and relevant interest must be articulated — not an abstract "we need data."
- Necessity. It must be demonstrated that the goal cannot be achieved in a less intrusive manner than mass collection of personal data.
- Balancing. Weigh your interest against the fundamental rights and reasonable expectations of the individuals whose data is being collected — and show that it does not outweigh them.
Moreover, the document must exist in advance, rather than being created post-factum. As noted by Brian Hengesbo, Global Head of Data & Cyber Practice at Baker McKenzie, when investigating a complaint, the regulator will first request the assessment of legitimate interest and supporting documentation. No paperwork — no protection.
Data Minimization: Filter Before Collection, Not After
The EDPB requires embedding protection at the design stage, even before the first request. The controller must:
- set precise collection criteria, rather than indiscriminately gathering everything;
- apply filters that exclude sensitive categories of data;
- exclude specific websites — particularly those aimed at minors and sites that have anti-scraping protections;
- apply post-processing after collection: syntactic filtering and anonymization.
The point about "sites with anti-scraping protections" deserves to be read twice. The EDPB is essentially saying: if a resource has clearly implemented anti-bot barriers, circumventing them is a signal that you are acting against the owner's will and the reasonable expectations of users. This is not about the CFAA or hacking; it is about balancing interests within GDPR.
Special Categories of Data — Almost Taboo
Data concerning health, political views, religion, sexual orientation (Art. 9 GDPR) is fundamentally prohibited from being collected through scraping — and even unintentional capture (for example, from an open social media post) triggers a strict prohibition. For lawful processing, both a basis under Art. 6 and an exception under Art. 9(2) are required, which mass scrapers usually lack. The EDPB demands control throughout the entire lifecycle — including filters on the output of the model and restrictions on prompts after deployment.
Why a Unified Document Appeared Right Now
Until now, Europe has responded to scraping for AI in a fragmented manner, through national authorities — and the results have been inconsistent. The Italian Garante fined OpenAI 15 million euros in December 2024 for training ChatGPT without a proper legal basis and violating transparency requirements. However, in March 2026, the Rome court overturned this sanction — a clear illustration of how shaky the legal ground was. The Irish DPC, in 2024, through an appeal to the High Court, secured an order for X to permanently cease training the Grok chatbot on public posts from European users during the period from May 7 to August 1, 2024. Additionally, there were separate actions by Dutch and French regulators.
This patchwork landscape created uncertainty for both companies and citizens. Guidance 03/2026 builds upon the earlier "Opinion 28/2024" on AI and for the first time establishes a unified standard for all 27 countries. On the same day, the EDPB also adopted a paired guidance on anonymization, where it established a criterion of three conditions: data is considered anonymous only if it is impossible to identify a specific record, link records together, or derive new information about an individual. As EDPB Chair Anu Talus stated, the documents "set clear standards that facilitate data use while simultaneously protecting individuals' fundamental rights."
What This Means for Data Collectors
First and foremost: this concerns the territorial scope of GDPR. If your sample includes personal data of EU residents — the regulation applies regardless of where you are located. This applies not only to LLM laboratories: any organization that scrapes data directly or through contractors — whether for retraining a model or for sentiment analysis — falls under these requirements.
Second — the practical divide occurs based on type of data, not method of access:
- Non-personal data — prices, product availability, characteristics, public texts without personal ties, market analytics — remain a low-risk zone. Price monitoring, catalog parsing, and collecting SERP structures under GDPR concerning personal data do not apply.
- Personal data — profiles, contacts, behaviors of specific individuals — are now fully under GDPR, even if they are publicly available. Legal basis, documented legitimate interest testing, minimization, and early anonymization are required here.
Third — data collection hygiene, which the EDPB has effectively made mandatory: narrow selection criteria, filtering of personal and sensitive data at the input stage, anonymization as early as possible, respect for anti-scraping barriers and sites for minors, and a public privacy policy describing scraping.
Where Proxies Fit In — and Where They Don't
It is important to honestly separate two dimensions that the EDPB has clarified first. The choice of infrastructure — residential, mobile, or data center proxies — determines reliability, geolocation, and success rate of requests, which is the technical side of collection. However, it does not change your legal basis. A residential IP does not turn illegal processing of personal data into lawful processing — compliance resides in what you collect and why, not in the address from which the request is sent. This, by the way, is good news for honest projects: if you are parsing non-personal data or properly filtering and anonymizing personal data, a quality proxy infrastructure addresses the technical task while you remain compliant in substance.
The same logic applies to agent-based scraping, where AI agents write parsers themselves: the tool has become smarter, but the rules for data processing have not softened — on the contrary, the EDPB explicitly extends the requirements to such pipelines.
Conclusion
Guidance 03/2026 does not prohibit web scraping — it dispels the convenient illusion that data openness removes the question of their processing. In the EU, the era of "public means free" for personal data ended on July 8, 2026. For data collectors, this is not a death sentence but a shift in discipline: separating personal from non-personal, filtering at the input stage, early anonymization, and documenting legitimate interest before, not after, a regulator's request. The technique is still determined by proxies and anti-detect; legality is now determined by what exactly you put into your database.