EPIC urges EDPB to extend draft web scraping guidelines to data brokers and tighten GDPR limits

The Electronic Privacy Information Center (EPIC) has submitted comments on the European Data Protection Board’s draft Guidelines 03/2026 on web scraping in the context of generative AI, which the EDPB opened for comment in July 2026.

EPIC argues that the draft covers only organisations that scrape for AI training or acquire previously scraped datasets. In its view, this lets data brokers that scrape for multiple purposes fall outside the guidelines. It contends that legitimate interest will rarely survive the balancing test. Citing academic work by Daniel Solove and Woodrow Hartzog, it also says that a website notice, which the draft offers as an option when notifying individuals is disproportionate, would be “practically useless”.

EPIC calls for a central registry of scrapers and dataset buyers and an opt-in default signalled through robots.txt. It also wants mandatory cleaning steps, including human review, removal of sensitive data and a documented risk assessment.

Editor’s note: This article relies solely on the comments and summary published by EPIC, an advocacy group; the EDPB draft guidelines themselves were not reviewed.