Leaked EU Council Draft Proposes Default AI Training on European Personal Data

Privacy advocates argue that a newly leaked European Council document represents the quiet dismantling of the continent’s foundational data protection laws, handing tech companies a blank check to scrape personal information for artificial intelligence training. European member states, conversely, position the exact same text as a necessary modernization of the General Data Protection Regulation (GDPR), arguing that without a default pathway to utilize public data, the bloc's domestic AI industry will be permanently outpaced by American and Chinese competitors.[1][5]

The friction centers on a leaked draft proposal circulating among EU member states, which introduces a new provision—often referred to as Article 88bis—that would explicitly make the use of personal data for AI training lawful by default. Under the current GDPR framework, companies must establish a specific legal basis, such as explicit user consent or a strictly defined "legitimate interest," before processing personal data, a hurdle that has stalled several high-profile model launches in Europe.[3][4][5][6]

According to the leaked text, the unconditional right for European citizens to opt out of having their data ingested by machine learning models would be dropped entirely. Instead, the burden would shift to the user to navigate complex, often opaque technical mechanisms to shield their information from web scrapers, provided the AI companies even offer a functional opt-out mechanism.[1][3][4]

The privacy rights organization NOYB (None of Your Business), which published the leak on September 21, 2026, has aggressively condemned the proposal. The group described the draft as a "digital expropriation" of European citizens, engineered specifically to serve the commercial interests of generative AI developers. Max Schrems and his organization argue that the amendment effectively legalizes the mass scraping practices that data protection authorities across the bloc have spent the last two years investigating and penalizing.[3][5]

From a technical perspective, the proposal addresses a genuine bottleneck in frontier model development. Generative AI systems require trillions of tokens of text and billions of images to map the statistical relationships that allow them to function. Filtering out European personal data from these massive, globally scraped datasets is computationally expensive and technically imprecise, leading many developers to simply delay launching their models in the EU rather than risk massive fines.[2][6]

The draft suggests that member states are growing increasingly anxious about this technological isolation. By loosening the GDPR's strict consent requirements, the Council appears to be prioritizing the growth of a domestic AI ecosystem over the strict interpretation of privacy rights that has defined European tech policy for the last decade. The marketing language surrounding "AI innovation" often frames this as a necessary compromise for economic survival.[2][6]

However, critics point out that this framing ignores the reality of what the models actually do with the data. Because large language models compress and memorize aspects of their training data, personal information ingested during training can sometimes be regurgitated in response to user prompts. This creates permanent privacy vulnerabilities that cannot be easily patched or deleted once the model weights are finalized.[1][5]

The leaked draft is currently being negotiated behind closed doors by the member states in the Council of the European Union. If the member states agree on a common position, the text will still need to survive negotiations with the European Parliament, which has historically taken a much harder line on data protection and user consent. The outcome will dictate whether Europe remains a strict privacy regulator or pivots to accommodate the data demands of the generative AI boom.[4][6]