Your public posts are training AI. Europe just said public doesn't mean up for grabs.

This week in Brussels, the European Data Protection Board (EDPB, the body that brings together the privacy regulators of every EU country) adopted guidelines dedicated to web scraping for generative artificial intelligence, the automated, large-scale harvesting of content published on the internet to train models like ChatGPT or Gemini, announced on July 8 at the close of its plenary. It also adopted new guidelines on anonymisation. The central message fits in one sentence: having published something in plain sight gives no one a free pass to use it.

For years, the AI industry ran on an unwritten rule: if it is accessible, it is raw material. Posts, photographs, forum comments, CVs and forgotten blogs were hoovered up by the ton to train the models we use today, almost always without their authors knowing. The EDPB itself acknowledges it: web scraping "often operates without individuals being aware" and may pose significant risks to their personal data.

What the EDPB actually said

The GDPR, Europe's data protection regulation, applies whenever scraping involves personal data. Those who collect it usually invoke "legitimate interest", but that interest has to pass a balancing test, the commercial interest of whoever trains the model cannot trample the rights of whoever published. And the Board gives concrete examples of what weighs in that test:

• A website without a robots.txt file (the file that tells scraping bots to stay out) does not amount to consent. The absence of a prohibition is not a yes.
• If a website requires a login, uses CAPTCHA (the "I am not a robot" tests) or states that it does not allow AI training, whoever scrapes it cannot claim people expected it.
• Sensitive data, such as health, sexual orientation or political opinions, is in principle off limits.
• Those training models should exclude risky sources and data categories by default, publish the list of scraped websites, offer prior opt-out mechanisms, and delete or anonymise unnecessary personal data as soon as possible.

The document goes as far as describing a company that collects publicly available voice recordings to build a voice generator without any additional safeguards. That company, says the EDPB, cannot rely on legitimate interest. And the twin guidelines on anonymisation tighten the other side of the equation: data is only anonymous if no one can be singled out, linked or inferred from it, a bar much of what the industry calls "anonymous" does not clear.

The harvest has already happened

The uncomfortable part needs saying: these guidelines are under public consultation until October 30, 2026, and they arrive after the harvest. The big models have already been trained on decades of internet, and removing data from a trained model is technically close to impossible, there is no delete button.

Even so, it would be a mistake to file this away as late bureaucracy. National data protection authorities now have a common yardstick to measure complaints and audit whoever trains and sells models. When Meta announced in 2025 that it would train its AI on the public posts of adult users, Portugal's authority, the CNPD, alerted users and shared the objection forms. With these guidelines, that kind of standoff no longer plays out on vague ground, the criteria are written down, and whoever scrapes now has to prove they meet them.

How you protect yourself

What is within your reach today:

• Review what you have public. Old posts, photographs and open profiles are candidates for raw material; if it does not need to be visible to everyone, do not leave it visible.
• Use the platforms' objection mechanisms. Meta provides forms to refuse having your content train its AI; the CNPD alert links to them.
• If you run a website, make the refusal explicit. robots.txt or ai.txt, CAPTCHA and terms banning AI training are no longer symbolic, they now carry legal weight.
• If this matters to you, take part in the EDPB public consultation until October 30, 2026. The final rules are being written now.

Public describes where you put your words, not what others may do with them. Europe has just put that difference down in black and white.

Sources: EDPB, CNPD.

#StaySafe
🙏🖖