EU Council backs broader access to personal data for AI

EU Member States have approved a negotiating position on GDPR changes that would generally make processing personal data for AI lawful. The Council of the EU approved the text on 21 October 2026 as part of the European Commission’s Digital Omnibus proposal. Companies using or training AI products would be presumed to have an overriding legitimate interest, removing the need for user consent. The provision would also cover noncustomers and older material, including chats and social media posts.

Privacy critics say the proposal replaces purpose-based restrictions with a broad legal basis tied to a technology. Austrian activist and lawyer Max Schrems warned that activities currently unlawful without consent, including personalised advertising, could become permissible when conducted using AI. Critics also say references to existing rights to object and compliance duties add no material safeguards. The Commission presented the package as simplification and used a fast-track procedure without a fundamental rights assessment, according to the announcement.

Member States also proposed narrowing the definition of personal data, potentially placing pseudonymous identifiers outside GDPR protections and creating uncertainty over online tracking. The Council’s position is not final law: negotiations with the European Parliament and Commission remain ahead, and Parliament has yet to adopt its position. If adopted, the changes could face a fundamental-rights challenge before the Court of Justice of the EU.