EDPB Web Scraping Guidelines: Consent Won't Work for AI Training, Legitimate Interest Is the Only Path
Not legal advice. This article discusses legal and regulatory developments and is generated with AI assistance under human editorial review. It is provided for informational purposes only and does not constitute legal advice. Laws and regulations vary by jurisdiction and are subject to change. You should consult your own qualified legal counsel before taking or refraining from any action based on the content of this article. Read our AI Transparency statement.
The News
On 7 July 2026, the European Data Protection Board (EDPB) published draft Guidelines 03/2026 on web scraping in the context of generative AI, now open for public consultation. According to analysis by Sidley Austin, the EDPB rules out consent as a viable legal basis for large-scale scraping, noting that freely given, informed consent is "likely unworkable in practice" when personal data are collected indirectly and at scale. The guidelines instead map a legitimate interest pathway, requiring controllers to satisfy all three limbs of the test: identify a legitimate interest, demonstrate necessity, and conduct a documented balancing exercise weighing their interests against data subjects' rights. The EDPB also addresses data minimisation, transparency obligations, and the role allocation between scrapers and AI developers — confirming that organisations acquiring pre-scraped datasets bear independent controller responsibility for their use of that data.
Why It Matters
Most TA leaders won't scrape web data themselves, but many procure AI recruiting tools whose models were trained on publicly available personal data — LinkedIn profiles, GitHub repositories, public CVs. The EDPB's position means those vendors must have documented legitimate interest assessments for their training data, not just consent mechanisms that don't work. If a vendor can't explain the legal basis for their training dataset, that's a procurement risk. The guidelines also make clear that the organisation acquiring a pre-scraped dataset from a broker bears independent controller responsibility — meaning due diligence on upstream data sourcing is now a compliance obligation, not a nice-to-have.
Taking Action
All action is situated in your corporate context. These are starting points, not prescriptions — choose what fits.
Connect
Who to talk with in your enterprise
Your procurement or vendor management lead: Ask every AI recruiting vendor for their training data provenance documentation. Specifically: what is the legal basis for processing personal data in their training set? If the answer is "consent" for web-scraped data, that's a red flag under these guidelines.
Your data protection officer: Request a review of how your organisation's AI procurement due diligence addresses upstream training data sourcing. The EDPB confirms that acquiring pre-scraped datasets creates independent controller responsibility — meaning the liability doesn't stop with the vendor.
Inspect
What to take a closer look at
Pull the data protection impact assessment (DPIA) for any AI recruiting tool your team has deployed in the past 18 months. Check whether it addresses training data sourcing and legal basis. If the DPIA only covers how the tool processes candidate data at runtime — not how the underlying model was trained — it has a gap the EDPB guidelines now make conspicuous.
Reflect
What to think about more deeply
If your AI screening vendor trained its model on a million public LinkedIn profiles without a documented legitimate interest assessment, is that a vendor problem or an employer problem?