2026 legal update / Reviewed 12 November 2026
The EDPB published Guidelines 03/2026 on web scraping in the context of generative AI on 8 July 2026. Its consultation closed on 30 October 2026.
Keep the status clear
The publication and consultation are relevant developments, but the consultation text should not be described as a new statute or automatically as final guidance. The source pages distinguish the guideline document from the feedback process.
Audit the data-acquisition decision
Public availability does not by itself settle the lawfulness of processing personal data. A review should address purposes, legal basis, data categories, transparency, objections, retention and safeguards. Copyright, database rights and contractual access restrictions remain separate issues. Procurement teams should ask dataset suppliers for evidence rather than accepting a statement that all material came from the public web.
Four practical examples
Illustrative scenarios, not reports of client mandates. The appropriate response depends on the facts and applicable law.
Public profiles
A developer collects professional profiles. It assesses the purpose and data-protection implications rather than assuming public access equals unrestricted use.
Sensitive information
A crawler encounters health-related material. The team needs a process to identify and address categories requiring particular protection.
Dataset purchase
A buyer requests provenance and permission information from the supplier and assesses what its warranties actually cover.
Deletion request
An individual challenges inclusion in a training dataset. The organisation needs traceable records and a legally assessed response process.
Practical next step
Identify the systems, products or contracts affected, assign a responsible owner and preserve the documents supporting your assessment. Read our related service page for the scope of legal support.