European Union member states have advanced a digital omnibus text that would permit artificial intelligence developers, including the creators of ChatGPT, Gemini, and Meta AI, to scrape and train models on personal user data without explicit consent under the legal doctrine of legitimate interest.
The Council of the European Union adopted a negotiating mandate on October 21 containing a newly proposed Article 88 bis of the General Data Protection Regulation. The provision spans the text of a sprawling 179-page digital omnibus package, overriding warnings issued by European data protection authorities.
How the Negotiating Mandate Rewrites Consent Rules
The current text fundamentally alters the architecture of data privacy established under the GDPR. Under the European Commission’s initial proposal from November 2025, individuals retained an unconditional right to opt out of data harvesting for AI training without needing to provide any justification.
EU governments backed a GDPR change for AI training on personal data. It is a Council negotiating mandate (21 Oct), not law: AI training would rest on legitimate interest. Parliament is next.https://t.co/FHxrI3zZr2#GDPR #AI #DigitalOmnibus
The Council removed that unconditional safeguard. In its place, the proposal leaves only the standard objection mechanism outlined in Article 21 of the GDPR. Under this framework, technology companies can bypass a user’s objection by demonstrating compelling and legitimate grounds for the processing operation.
The scope encompasses public posts, comments, and photographs accumulated across digital platforms over years. This data can be utilized both for the initial development of large language models and for their day-to-day operations.
Protections for vulnerable groups and sensitive information have similarly shifted. Special safeguards regarding children have been removed from the main body of the text and relegated to a simple considérant. Meanwhile, sensitive information concerning health, political opinions, and sexual orientation will be tolerated in training datasets provided their presence remains incidental and residual.
Where processing of sensitive data does occur, companies are required to erase it unless doing so proves technically impossible or demands a manifestly disproportionate effort. In such cases, technical containment is deemed sufficient compliance.
Precedents and Pushback from Regulators
European data protection authorities raised joint alarms regarding these practices as early as February 10. Those warnings ultimately did not shape the text adopted by the Council.
Meta has already tested similar legal ground. Since May 27, 2025, the company has trained its models on the public posts of adult European users under the legal basis of legitimate interest. German consumer protection organizations attempted to block the collection through emergency legal proceedings, but the Cologne Court of Appeal dismissed their challenge on May 23, 2025, ruling the operation lawful even in the absence of explicit user consent.
The Council’s mandate converts this contested judicial interpretation into explicit written rules applicable to any entity, ranging from early-stage startups to major American technology firms.
| Date | Milestone | Regulatory Status |
|---|---|---|
| November 2025 | Commission Proposal | Included an unconditional opt-out right for users. |
| February 10 | Data protection authority warning | European data protection authorities issued joint alerts. |
| October 21 | Council Mandate | Adopted the 179-page digital omnibus containing Article 88 bis. |
The Road Ahead in European Legislative Negotiations
Max Schrems, of privacy advocacy group noyb, characterized the Council’s position as a total handover of European data to multinational corporations. The organization previously filed eleven formal complaints against Meta AI regarding its data scraping practices.
The text currently represents only the Council’s negotiating position. The European Parliament has yet to establish its stance on the package, and formal trilogue negotiations between the institutions lack a confirmed schedule.
While a considérant in the text stipulates that developing an artificial intelligence model does not automatically constitute a legitimate interest and must be evaluated on a case-by-case basis, the inversion of the default rule remains the core point of contention. If Article 88 bis survives the legislative process in its current form, historical posts will become training material by default, leaving individual users to contest harvesting through platform-specific opt-out forms.
