Source: IAPP

Practitioners historically relied on legitimate interest as a defensible legal basis to train AI models, supported in part by the European Data Protection Board’s December 2024 opinion that set accountability conditions for such use. The European Commission proposed, via the pending Digital Omnibus, to enshrine this interpretation into the GDPR to align primary law with regulator guidance and on-the-ground practice.

A February 2026 joint opinion from the EDPB and EDPS agreed with the Commission’s premise but argued the inclusion was unnecessary and, if retained, required clearer conditions of application. Stakeholders raised concerns that the amendment could enable large-scale processing without user consent. Recent news indicates the Council of the European Union is considering removing the legitimate interest inclusion, a move that would effectively preserve the pre-Omnibus status quo but also send mixed signals about member states’ views. The primary short-term effect of these negotiations is increased legal uncertainty: removing the proposed language could erase some of the clarity gained from EDPB guidance (which is non-binding) and forfeit an opportunity for legislators to examine how GDPR legitimate interest requirements apply to real-world AI use cases. The debate’s outcome will have significant consequences for AI-based innovation in Europe and will influence how boldly companies operate in this space.