PrivacySignal
GDPR / Intl

EDPB discusses focuses in draft anonymization, AI web scraping guidelines

IAPP · · International · GDPR & International

The European Data Protection Board is developing draft guidelines that address both anonymization standards and the use of AI web scraping, signaling a move to clarify how these practices align with EU data protection rules. The guidelines are still in draft form and reflect the EDPB's current enforcement and policy priorities.

Why this matters: Two issues in one set of guidelines, and both matter a lot. Anonymization rules determine whether companies can use your data freely or not — get the standard wrong and 'anonymous' data is just personal data with a fig leaf. Web scraping for AI training is how most large models were built, often without asking anyone. If the EDPB sets real limits here, it affects every AI company pulling data from the open web. These are not abstract rules. They decide whose data gets used, for what, and whether anyone is accountable for it.

Who should care: Lawyers · Privacy officers · AI governance · General readers · Policy

This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.

Analysis

All analysis →

Weekly Editorial Analysis from Experts and Editors

Logged Is Not Authorized

Georgia law restricts police use of license plate data to law enforcement purposes. A new lawsuit alleges deputies searched a man's vehicle five times while he was suing their sheriff. Two recorded reasons were "info" and "37." The system accepted both.

· 6 min read Read →
Deep Signal · Part I of III

The Algorithm Said So

Federal rulemakers are deciding what to do when artificial intelligence produces the kind of conclusion that once required an expert. They disagree about how to regulate it. They also disagree about whether the problem has arrived.

· 10 min read Read →

Related stories

GDPR / Intl
EDPS · · EU

New episode of Newsletter Digest

The European Data Protection Supervisor released a newsletter digest episode covering data protection and digital policy developments from October, which coincided with European Cybersecurity Month.

Who should care: Lawyers · Privacy officers · AI governance · General readers · Policy

#gdpr#privacy Read original →
GDPR / Intl
Inside Privacy (Covington) · · International

CPPA Proposes Amendments to Opt-Out Preference Signal Regulations

California's privacy agency has proposed amendments to CCPA regulations on opt-out preference signals, explicitly naming the Global Privacy Control as a signal that businesses engaged in selling or sharing personal data are required to honor.

Who should care: Lawyers · Privacy officers · Compliance · General readers · Policy

#state-privacy#regulation#privacy Read original →
GDPR / Intl
EPIC · · US Federal

EPIC Comments to EDPB on Guidelines on Web Scraping for AI: Go Further

EPIC submitted comments to the European Data Protection Board urging it to strengthen its draft guidelines on web scraping for AI, arguing the current framework does not go far enough to protect personal data collected from the web.

Who should care: Lawyers · Privacy officers · AI governance · General readers · Policy

#gdpr#ai#privacy Read original →
GDPR / Intl
M Minnesota Attorney General's Office · · International

Attorney General Ellison wins $7.1M from General Motors for sharing drivers’ private data

Minnesota Attorney General Keith Ellison secured a $7.1 million settlement from General Motors over the automaker's sharing of drivers' private data. The action follows scrutiny of how GM collected and distributed sensitive driver information without adequate consent.

Who should care: Lawyers · Privacy officers · Compliance

#state-privacy Read original →
GDPR / Intl
ICO · · UK

ICO statement on Highly Effective Age Assurance

The UK's Information Commissioner's Office has issued a statement on highly effective age assurance, addressing standards or expectations around how online services verify users' ages. The ICO is the UK's data protection regulator and its statements carry significant weight for how platforms must operate.

Who should care: Lawyers · Privacy officers · AI governance