Transparency and Information Requirements for AI Web Scraping Under the GDPR

Anyone who collects web data to train generative AI must, in principle, inform the data subjects. With very large volumes of data, however, individual notification is often hardly feasible. This article explains the requirements of Art. 14 GDPR, the exemption under Art. 14(5)(b) GDPR and the requirements of EDPB Guidelines 03/2026.

Publicly accessible does not mean exempt from data protection

Crawlers collect, for example, names, professional and location details, opinions or entire conversation histories. This information can often be attributed to individuals, and special categories of data under Art. 9 GDPR may also be captured. For such data, a legitimate interest alone is not sufficient; an exemption under Art. 9(2) GDPR is additionally required.

In practice, the processing is usually based on legitimate interests under Art. 6(1)(f) GDPR. This requires three questions to be examined:

1. Does the controller have a specific and lawful interest?
2. Is the processing genuinely necessary for that purpose, or is there a more data-minimising solution?
3. Does this interest outweigh the rights and interests of the data subjects?
4. A key factor is whether data subjects could reasonably expect the processing and how severely their rights are affected. Publicly accessible information is not exempt from data protection. Because web data is not collected directly from the data subjects, the information obligations of Art. 14 GDPR apply in principle.

What information does Art. 14 GDPR require?

Under Art. 14(1) and (2) GDPR, controllers must provide information in particular on:

• their identity and contact details and, where applicable, the contact details of the data protection officer,
• the purposes of the processing and the legal basis and, where Art. 6(1)(f) GDPR applies, the legitimate interests pursued,
• the categories of personal data processed,
• recipients or categories of recipients and any intended transfers to third countries,
• the storage period or the criteria used to determine it,
• the rights of the data subjects, in particular the right to object and the right to lodge a complaint, and
• the source of the data.
• Under Art. 14(3) GDPR, the information must be provided within a reasonable period after obtaining the data, but at the latest within one month. If the data is used to communicate with the data subject, information must be provided at the latest at the time of the first communication; if it is disclosed to third parties, at the latest when it is first disclosed.

When can the information obligation be waived under Art. 14(5)(b) GDPR?

Individual notification may be omitted where it would prove impossible or involve a disproportionate effort. The “Guidelines 03/2026 on web scraping in the context of generative AI” acknowledge that individual notification may be difficult, impracticable or objectively impossible where very large volumes of data are involved. This does not, however, result in an automatic exemption for web scraping.

As early as 2024, the EDPB’s ChatGPT Taskforce stated that the exemption could apply if all statutory requirements are met. According to Guidelines 03/2026, however, controllers should not routinely rely on it outside archiving purposes in the public interest and scientific, historical or statistical purposes.
Controllers must document why the effort of individual notification is disproportionate to the consequences for data subjects. The assessment covers the dataset as a whole, not each individual data item. Factors to be considered include in particular:

• the number of data subjects,
• the age of the data, and
• the safeguards adopted.

What must controllers publish?

Where the exemption applies, the obligation does not lapse entirely. Under Art. 14(5)(b) GDPR, controllers must take appropriate measures to protect the data subjects’ rights and freedoms and legitimate interests, including making the information publicly available.

In the EDPB’s view, publication must always take place, for example in the privacy policy or in a dedicated notice on the website. In addition to all the mandatory information listed above, controllers must explain:

• how the crawler used works and what characteristics it has, and
• whether the data originates from publicly or non-publicly accessible sources.

The data sources must be described as precisely as possible. Where a complete list is impossible, it must be as comprehensive as possible and state the types of sources omitted and the reasons for their omission.

The EDPB recommends making domain names and URLs searchable and stating the collection period. Anyone receiving datasets already collected by third parties should also provide a contact for the original controller and explain the collection conditions clearly and simply. All information must be easy to find and understand.

Further measures can improve transparency and mitigate risks. EDPB Opinion 28/2024 mentions, for example:

• public notices with additional information on selection criteria and datasets,
• information campaigns in the media or by email,
• graphics and other easily understandable visualisations,
• FAQs, transparency labels and model cards, and
• voluntary annual transparency reports.

Why the quality of the published information is decisive

The GDPR does not require individual notification at any cost in the context of web scraping. Controllers must, however, justify why it is impossible or would involve a disproportionate effort, and provide a reliable public alternative.

Under Guidelines 03/2026, merely asserting a high effort is not sufficient. What matters is a documented balancing exercise and meaningful public information, especially on sources, categories of data and the crawler. How supervisory authorities and courts will apply this remains to be seen.

The “Guidelines 03/2026 on web scraping in the context of generative AI” are a draft under public consultation. Comments may be submitted until 30 October 2026 via the form on the EDPB website. As the text may still change, documentation should be easy to adapt.