GDPR Applies to AI Training Data: EU Ends Web Scraping Free Pass for…

The EU's Data Protection Board issued binding guidelines (03/2026) establishing that GDPR applies fully to web scraping for AI training, eliminating the assumption that public data is freely available. Developers must now conduct per-deployment legitimate interest assessments, apply data minimisation filters before scraping begins, and meet strict anonymisation standards that most LLMs cannot currently satisfy. If you're training a model on scraped web data, you now need a legal opinion per deployment and proof you filtered personal data before collection—not after. The free pass on public data just expired.