Artificial intelligence developers could gain broader access to Europeans’ personal information under proposed changes to the European Union’s privacy laws. The plan has drawn criticism from digital rights advocates who warn that it could weaken protections established by the General Data Protection Regulation (GDPR).
The controversy centers on the Digital Omnibus initiative, which seeks to simplify EU technology regulations and make it easier for businesses to develop AI systems. On October 21, 2026, EU member states agreed on a negotiating position supporting changes to the rules governing personal data processing.
A key provision would explicitly recognize legitimate interests as a potential legal basis for processing personal information when developing and operating AI systems. This could allow companies to use certain personal data without obtaining individuals’ explicit consent, provided they meet the applicable legal requirements.
Privacy organization noyb has strongly criticized the proposal, arguing that it could give major technology companies excessive freedom to exploit information collected from European users. The group fears that the changes would shift the balance of power toward businesses seeking large datasets for AI training.
The implications could extend beyond information deliberately shared with AI services. Personal data collected through websites, applications and other digital platforms may become relevant to AI development, depending on the final legislation and the circumstances in which that information was obtained.
Supporters of regulatory simplification argue that existing requirements create legal uncertainty and unnecessary obstacles for European businesses competing in the global AI industry. Easier access to suitable training data, they contend, could encourage innovation and help smaller companies develop competitive technologies.
However, the proposal would not create an unrestricted right to collect or process personal information. Legitimate interests remain subject to legal conditions, including consideration of individuals’ rights and the availability of objections in applicable circumstances.
The debate also raises questions about how effectively people can control information once it has been incorporated into AI training processes. Privacy advocates argue that greater clarity is needed about data sources, transparency obligations, and the practical enforcement of individual rights.