The EDPS highlights anonymization and harvesting for generative AI and adopts the final version of the guidelines on blockchain.

2026-07-09 · Source: RSS - Actualités CNIL · Field: Legal & Regulatory — Compliance & Risk Management, Regulatory Affairs & Government Relations · Depth: Intermediate, medium

Summary

On July 7, 2026, the European Data Protection Board (EDPB) adopted new guidelines clarifying anonymisation and web scraping for generative AI, alongside finalizing its guidelines on blockchain technologies. The anonymisation guidelines define anonymous data, considering CJEU judgments like C-413/23 P, EDPB/CRU, of September 4, 2025. They offer a practical framework with "contextual" and "simplified" approaches, using three criteria: no individualisation, no correlation, and no inference, for successful anonymisation. Separately, the scraping guidelines address GDPR compliance for large-scale data extraction in AI development, detailing legal bases, conditions for processing special categories of data under Article 6 and Article 9(2), and principles like purpose limitation, transparency, accuracy, and data minimisation. Both the anonymisation and scraping guidelines are open for public consultation until October 30, 2026. The finalized blockchain guidelines assist organizations in GDPR compliance for data processing using distributed ledger technologies.

Key takeaway

For legal professionals and AI developers navigating data privacy, these EDPB guidelines are crucial. If you are involved in generative AI development or data processing, you must review the new anonymisation framework and web scraping rules to ensure GDPR compliance. Pay close attention to legal bases for scraping and strict conditions for handling special categories of data. Additionally, organizations using blockchain should consult the finalized guidelines to align their data processing architectures with GDPR requirements, mitigating potential legal risks.

Key insights

EDPB guidelines clarify GDPR compliance for anonymisation, web scraping in AI, and blockchain data processing.

Principles

• Anonymous data must not relate to an identifiable person.
• Scraping for AI must adhere to GDPR principles.
• Processing special categories of data is generally prohibited.

Method

The anonymisation framework assesses differences in identification capabilities ("contextual approach") or simplifies by ignoring them ("simplified approach"), then applies 3 criteria.

In practice

• Apply the 3 anonymisation criteria for data safety.
• Extract data only from reliable sources for AI training.
• Implement technical measures to prevent special data collection.

Topics

• GDPR Compliance
• Data Anonymisation
• Web Scraping
• Generative AI
• Blockchain Technology
• European Data Protection Board

Best for: CTO, VP of Engineering/Data, Director of AI/ML, Legal Professional, Policy Maker, AI Ethicist

Related on AIssential

• Data protection digest 3 – 17 Jul 2026: blockchain latest, ‘humanless’ resources & AI-repellent fashion — Regulatory bodies are actively defining GDPR compliance for emerging technologies like AI and blockchain, while enforcement actions highlight persistent data protection challenges.
• Researchers propose 'copyleft' rules for generative AI — Generative AI challenges FOSS transparency, leading researchers to propose "copyleft" rules for reciprocal openness.
• How to DP-Fy Your Data: A Practical Guide to Generating Synthetic Data With Differential Privacy — Differentially Private synthetic data enables AI development by balancing data utility with robust individual privacy protection.
• # The Ladder Pulled Up Behind Them — The core asymmetry is AI labs freely learn from all but restrict others from learning from them.
• Authenticity Debt and the Synthetic Content Threat Landscape: A Layered Framework for Trust, Provenance, and IP Governance in the Generative AI Era — Authenticity debt accumulates when AI-generated content lacks verifiable origin, necessitating a layered trust framework.
• Your AI Translation Tool Might Be Training on Your Business Data — Here’s What to Do About It — AI translation tools can expose sensitive business data to model training, creating significant GDPR compliance risks.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by RSS - Actualités CNIL.