EU governments back a GDPR change that eases AI training on personal data

EU governments agree a GDPR position with an AI clause

EU member states have agreed their negotiating position on a package of changes to the General Data Protection Regulation, and it includes a new rule aimed squarely at artificial intelligence. The Council of the EU announced the mandate on Wednesday 21 October 2026 and added the text of the mandate to its press release the next day. Among dozens of edits to the GDPR is a new Article 88bis, headed "Processing in the context of the development and operation of AI".

The article says companies may process personal data to build and run AI systems and AI models on the basis of legitimate interest, one of the six legal grounds the GDPR already recognises, rather than asking people for consent. Supporters present it as a clarification that gives AI developers legal certainty. Critics see it as the biggest loosening of European data protection since the GDPR took effect in 2018.

The change is not law yet. The Council position is one side of a three-way negotiation with the European Parliament and the European Commission, and Parliament has not adopted its own position. But the vote matters because it shows where the governments of the 27 member states stand, and because the AI clause survived several rounds of drafting under the Irish presidency. The EU already sent information requests to frontier AI labs this month under the AI Act, so the bloc is regulating AI companies on several fronts at once.

What Article 88bis says

According to the EUTechReg tracker of Council texts, Article 88bis has three paragraphs. The first says the processing of personal data "in the context of the development and operation of an AI system or of an AI model" may be carried out for a legitimate interest of the controller or a third party, in line with Article 6(1)(f) of the GDPR. The second says this does not remove the controller's duty to choose an appropriate legal ground under Article 6. The third says that, whatever the legal ground, such processing must be covered by appropriate technical and organisational measures and safeguards, including the right to object under Article 21.

The clause was not in the original text. The Commission's November 2025 proposal put a similar rule in an Article 88c, the tracker shows, and the Council's drafts from May and June did not include the AI article at all. It first appeared as Article 88bis in a compromise text dated 3 September 2026, and its three paragraphs were rewritten in a 2 October text, which is the version member states then backed. The reference to the right to object was one of the late additions.

The Council's own summary is short. It says the mandate "introduces safeguards" to a proposed exception allowing sensitive data to be processed for biometric verification and for the development and operation of AI systems, and that AI is "further supported with clarifications on the lawful ground for processing personal data and need to maintain appropriate safeguards." The legal analysis site Praxikon notes that the recitals in the September text said AI processing "may be regarded" as a legitimate interest unless the rights of the person concerned prevail, in particular where that person is a child.

Why legitimate interest matters for AI training

Under the current GDPR, every use of personal data needs a legal basis. Consent is the best known, but legitimate interest is often more practical for large-scale processing, because it does not require asking each person. To rely on it, a company must run a three-part test: it has a genuine interest, the processing is necessary for that interest, and the interest is not overridden by the rights and freedoms of the people whose data is used.

AI developers have leaned on legitimate interest for years, especially for web-scraped training data, but national regulators have disagreed about how far it stretches. Writing a specific AI provision into the regulation would make it much harder for a regulator to argue that AI training can never be a legitimate interest. It would also help companies that already hold large stores of user data, from social networks to email providers. That debate is not abstract: this week Google said it can use Gmail and Photos data for ads when people connect them to its Personal Intelligence features.

Praxikon's reading is that the balancing test does not disappear. Because the article says controllers must still pick a suitable legal basis and apply safeguards, a company relying on it would still need a documented assessment. The difference is where the burden falls: instead of explaining why AI use is allowed at all, a company would mainly have to show that its safeguards work.

The rest of the Council package

Article 88bis is one part of a broader package the Council calls Omnibus VII, part of the EU's push to simplify digital rules for businesses. The separate AI part of the omnibus, which delays some AI Act obligations for high-risk systems, was adopted on 29 June 2026 and is already law.

For the GDPR, the Council says its mandate keeps the current definition of personal data but adds a provision on pseudonymisation, meaning data where direct identifiers are replaced with codes. It introduces a principle-based definition of scientific research with targeted exemptions for research organisations, makes it easier to reject unfounded or excessive requests, and simplifies some information duties in low-risk cases. It also backs a longer deadline for notifying personal data breaches, a single EU list of processing likely to be high risk, and common templates for compliance.

The Council presents all of this as simplification that maintains strong protection. The package also covers privacy and cyber incident reporting rules outside the GDPR, which are less relevant to AI.

The case against: digital expropriation

The privacy group noyb, founded by Austrian lawyer Max Schrems, called the vote a "digital expropriation" of Europeans. In its reading, the article means processing personal data in the context of AI is generally assumed lawful, covering people who were never customers of an AI company and data shared decades ago in chats or on social media. Schrems said: "On Wednesday, the EU Member States have agreed to take our data and feed it to AI companies for free."

noyb argues the Council's added references to the right to object under Article 21 and to the general accountability duty in Article 24 add nothing, because those rules apply to any processing anyway. It also says the clause legitimises a whole technology rather than a specific purpose, which is unusual for the GDPR. As an example, it says personalised advertising without consent, currently unlawful in the EU, could become lawful if it is done with AI. "If something is illegal in an Excel spreadsheet, it's legal if done with an AI agent," Schrems said.

The group also objects to the pseudonymisation changes, arguing that many IT systems work mainly with pseudonyms such as user IDs, tracking IDs and IP addresses, and that companies would end up deciding whether their own data counts as personal. The Council says the definition of personal data is unchanged. noyb says Germany and other large member states supported the text, and notes that Ireland, home to the EU headquarters of most big US and Chinese AI companies, holds the Council presidency.

What it means for AI companies and users now

For now, nothing changes legally. The GDPR applies in full, and AI developers cannot rely on Article 88bis until it is agreed with Parliament and published in the EU's Official Journal. Data protection authorities continue to judge AI training case by case, and courts continue to shape the limits; Clearview AI, for instance, is still fighting a UK privacy fine over its face database.

For companies building AI in Europe, the vote is a strong signal that member states want a clearer, more permissive basis for training on personal data. Legal teams will still need balancing tests, records of processing and, in many cases, data protection impact assessments. For users, the most practical right remains the right to object, which several platforms already offer for AI training. How well people are told about their rights varies; WhatsApp help pages, for example, were found this month to hide chatbot orders not to recommend privacy regulators.

The vote also lands as AI companies face growing legal pressure over training data from other directions, including copyright cases such as Reservoir's lawsuit against Suno and Anthropic. A data protection rule would not settle those disputes, which turn on copyright law rather than privacy.

What happens next

The next step is the European Parliament. noyb says the centre-right European People's Party tends to favour loosening digital rules, while centre-left groups have pushed back and favour keeping the status quo, and some far-right groups also oppose what they see as a free pass for big tech. Once Parliament adopts its position, trilogue negotiations between the three institutions will decide the final wording, which could drop, narrow or keep the AI clause.

A legal challenge is also likely if the clause survives. noyb points out that the Court of Justice of the EU has struck down EU laws for less serious interference with fundamental rights, including rules on data retention and transfers of personal data to the United States. Until the final text is agreed, Article 88bis is best read as a statement of intent by EU governments: they want AI developers to have a clearer legal path to personal data, and they are prepared to fight Parliament for it.