EU GDPR Reform: AI Training Without Consent Explained 2026

The European Union is considering a significant GDPR reform that could allow artificial intelligence companies to train their models on personal data without obtaining explicit consent from each individual. This proposed change, part of a broader digital simplification package, has sparked debate about privacy, innovation, and the balance between fundamental rights and technological progress.

What Is the Proposed GDPR Reform?

On October 21, the Committee of Permanent Representatives (Coreper), which brings together ambassadors from EU member states, agreed on a negotiating position for the Digital Omnibus—a package aimed at simplifying digital rules. The Council published a 179-page document outlining modifications to the GDPR, the ePrivacy Directive governing cookies, the Data Act, and the NIS2 cybersecurity directive.

One of the key objectives is to streamline the training of artificial intelligence models by allowing companies to use personal data under a legal basis known as legitimate interest. This would mean that AI developers could potentially bypass the need to ask for permission from every individual whose data is used.

How 'Legitimate Interest' Could Change AI Training

Under the current GDPR, companies must have a valid legal basis to process personal data. Consent is one such basis, but it requires clear affirmative action from the individual. Legitimate interest is another basis that allows processing if it is necessary for the purposes of a legitimate interest pursued by the controller or a third party, provided that such interests are not overridden by the fundamental rights and freedoms of the data subject.

The proposal would make it easier for AI companies to invoke legitimate interest specifically for training models. This could accelerate development by reducing the administrative burden of obtaining consent from millions of users. However, critics argue that it may weaken individual privacy protections.

Why This Matters for Businesses and Consumers

For AI companies, especially startups and smaller players, the ability to train models on vast amounts of data without seeking consent could lower barriers to entry and foster innovation. It might also help Europe compete globally in the AI race, where data access is a critical advantage.

For consumers, the change could mean that their personal data is used in AI development without their explicit permission. While the GDPR still requires transparency and allows individuals to object to processing based on legitimate interest, the shift could alter the power dynamic between users and tech companies. The background to this story is set out in BrewDog Founder Faces GDPR Complaints Over Shareholder Emails. A related thread runs through Meta Smartglasses Filming Without Consent: What You Need to Know. Earlier coverage in Meta AI Agent Muse Leaks User Home Address Without Consent shows how the argument developed.

Key Takeaways from the Proposal

• The Council's position aims to simplify digital regulations through the Digital Omnibus package.
• AI training could rely on legitimate interest, reducing the need for individual consent.
• The proposal is not yet law; it must be negotiated with the European Parliament.
• Transparency and the right to object remain important safeguards for individuals.
• The reform could impact other areas like cookie rules and cybersecurity.

What Happens Next?

The Council's agreed position will now serve as the basis for negotiations with the European Parliament. The Parliament has not yet adopted its own position, and the final text will require agreement from both institutions. This process could take months or even years, and the outcome is uncertain. A closer look at the same subject appears in BrewDog Founder Faces GDPR Complaints Over Equity Punks Emails. Anyone following the wider picture can start with BrewDog Founder James Watt Faces GDPR Complaints Over Emails to E. The same theme surfaces in Overweight Woman Deformed Chairs She “Borrowed” From Neighbor Without Her Consent, which takes a different angle.

Stakeholders, including privacy advocates, industry groups, and member states, will have opportunities to influence the final legislation. The debate will likely center on how to balance the benefits of AI innovation with the protection of personal data. Context on how this played out before sits in Pregnant Woman Is Upset That Her Mother-In-Law Announced Her Pregnancy On Facebook Without Consent. A companion piece, Meta Tracks Keystrokes, Mouse Data to Train AI Systems, approaches the same subject from another angle.

Comparing Current GDPR and Proposed Changes

FAQ

The outcome of this debate will shape the future of AI development in Europe and set a precedent for how privacy and innovation can coexist. As the negotiations unfold, businesses and consumers alike should stay informed about the potential impacts on data protection and digital rights.