The GDPR Decision: Purpose, Necessity, and Balance

For web scraping used in generative-AI training, the GDPR question is not whether the source page was visible; it is whether a defined processing activity can be justified, limited, explained, and controlled. This chapter turns the CommonPool audit’s evidence of personal information into a legal decision structure, focusing on purpose limitation, data minimisation, transparency, lawful basis, reasonable expectations, and special-category data. The result is a way to test a proposal without treating “public” as consent or “legitimate interest” as a conclusion.

The European Data Protection Board’s Guidelines 03/2026 are the primary source for the GDPR account here. They were adopted in July 2026 as version 1.0 for public consultation, so they express the Board’s guidance rather than a final judgment resolving every future dispute. The accompanying academic paper applies privacy law and policy arguments to CommonPool, but its application is commentary and case analysis, not binding authority. That distinction matters: a legal rule and an argument about how the rule fits one dataset should not be given the same weight.

The processing activity comes before the legal basis

The GDPR applies when web scraping includes processing personal data. In this setting, “processing” covers more than the first request to a server. The EDPB identifies extraction, cleaning, structuring, and storing as examples. A dataset can therefore remain within the legal analysis even if the original page is no longer available, the image is separated from its page, or the released artifact contains only a URL, caption, and metadata.

Personal data is also broader than an explicit name. It can be information that directly identifies a person, such as a contact detail, or information that can identify them indirectly when combined with other information. The CommonPool audit’s findings illustrate the combinations that matter: a face, a resume, an address, a caption naming someone, an Exif location, or text linking a person to a characteristic. Whether a particular item legally qualifies still depends on the applicable law and facts, but a system cannot decide that nothing is regulated merely because it does not store a neat column called “name.”

The first task is to identify the actors and their decisions. The EDPB says the organisation performing the scraping is not necessarily the controller. A controller is the organisation that determines the purposes and essential means of processing. If an AI developer instructs a scraping company which sources and categories to use, the scraper may be a processor acting on those instructions, while the developer will generally be the controller. If two organisations jointly decide to develop a model and jointly set the collection criteria, they may be joint controllers.

A downstream user must conduct its own analysis as well. An organisation that obtains an already scraped dataset and trains a model is carrying out a processing activity with its own purposes and essential means. The original scraper may be responsible for the earlier collection, but the handoff does not transfer the downstream user into a zone without obligations. Legal status remains fact-specific; labels on a contract or a dataset are not a substitute for examining who actually made the decisions.

Once the activity and actors are clear, the GDPR principles narrow the question.

Purpose limitation asks what the data is for. Personal data should be collected for specified, explicit, and legitimate purposes, and not later processed in a way incompatible with those purposes. A general-purpose model can have many eventual uses, but that flexibility makes the initial purpose harder to articulate, not less necessary. “Improve the model” may be an objective, but a controller still needs to explain what development or service goal it represents and why the selected personal data belongs within it.

Data minimisation asks what is necessary. Personal data must be adequate, relevant, and limited to what is necessary for the purpose. The EDPB is careful not to equate large volume with automatic non-compliance. A large training set may be justified for a particular purpose.