EU governments back letting AI companies train on Europeans’ personal data without consent

Ambassadors from the EU's 27 member states, meeting as the Permanent Representatives Committee (Coreper), agreed the Council's position on the GDPR portion of the "Digital Omnibus" on Wednesday, keeping a clause that would let AI companies process personal data for the development and operation of AI systems under the GDPR's legitimate-interest ground rather than consent. The text, renumbered Article 88 bis from the Commission's November 2025 Article 88c proposal, is a negotiating mandate and not law; the European Parliament must still settle its position before a final version is agreed with the Commission. Noyb, the Vienna privacy group led by Max Schrems, called the change "nothing but a digital expropriation of Europeans," warning that Google, Meta and Microsoft could use collected data for any project involving an AI component.

Max Schrems, chair of the privacy group noyb, speaking at the Big Brother Awards in Bielefeld, Germany, in April 2015. Image: Eleleleven Flickr <https://commons.wikimedia.org/wiki/File:2015 Max Schrems 17227117226 .jpg / Wikimedia Commons, CC BY-SA 2.0 https://creativecommons.org/licenses/by-sa/2.0/ , cropped EU governments have backed a change to Europe’s privacy law that would let AI companies use people’s personal data to build and run their systems without asking for consent. Ambassadors from the 27 member states, meeting as the Permanent Representatives Committee Coreper , agreed the Council’s position https://www.consilium.europa.eu/en/press/press-releases/2026/10/21/digital-rulebook-council-agrees-position-to-simplify-data-protection-privacy-and-cyber-reporting-rules/ on the GDPR part of the “Digital Omnibus” on Wednesday, and the text published on Thursday https://data.consilium.europa.eu/doc/document/ST-14756-2026-INIT/en/pdf keeps the clause privacy campaigners have fought hardest. It is not law yet. The text is the Council’s mandate for negotiations with the European Parliament, which still has to settle its own position before the two sides, with the European Commission, agree a final version. What the Council agreed The clause, which the Commission proposed in November 2025 as Article 88c and the Council has renumbered Article 88 bis, says the processing of personal data “in the context of the development and operation of an AI system or of an AI model may be carried out for a legitimate interest of the controller or a third party” under Article 6 1 f of the GDPR. Legitimate interest is one of the GDPR’s six legal grounds for using personal data, and unlike consent it doesn’t need anyone to say yes. A company weighs its own interest against people’s rights instead, and people can object. It is the ground Meta relied on when it began training its AI models on adults’ public Facebook and Instagram posts in the EU in May 2025, which is why Europeans have an objection form that people elsewhere don’t get https://madrobot.blog/2026/09/24/ai-chatbot-privacy-compared-openai-anthropic-google-meta-microsoft-apple/ . Writing it into the law would give every AI developer that footing. What the Council changed Member states rewrote parts of the Commission’s draft. They cut a line that promised people “an unconditional right to object” to the use of their data for AI. In its place, the Council text says AI processing must have “appropriate technical and organisational measures and safeguards”, “including the right to object under Article 21”. Under Article 21, a company can turn an objection down if it shows “compelling legitimate grounds” that override the person’s rights. A new recital adds that “the development and operation of an AI system or AI model does not in itself constitute a legitimate interest”, that each use is to be judged “on a case-by-case basis”, and that people’s rights can override a company’s interest, “in particular where the data subject is a child”. The Council also narrowed a separate exemption for sensitive data, such as health or religious beliefs, to data that ends up in training sets “incidentally and residually”. Companies must erase it once they find it or, where that is technically impossible, stop it being used to infer outputs or passed on. “A digital expropriation of Europeans” noyb https://noyb.eu/en/ai-eu-member-states-approve-digital-expropriation-europeans-ai-companies , the Vienna privacy group led by Max Schrems, said Germany and other big member states backed the text, and that the Council’s added references to existing rights would apply to any processing anyway. Schrems called the change “nothing but a digital expropriation of Europeans”: Now, Google, Meta and Microsoft can just use all the data they’ve collected with almost no limits and for any project that involves some ‘AI’ component. This is the biggest gift that EU Member States have ever made to US Big Tech. Max Schrems, chair, noyb The group argues the clause legitimises a whole technology rather than a specific purpose, so it would cover data people posted years ago and people who have never used an AI product. It also pointed out that Ireland, which holds the Council presidency, hosts the EU headquarters of most US and Chinese AI companies. Schrems put the objection this way: If something is illegal in an Excel spreadsheet, it’s legal if done with an AI agent. It’s utterly absurd to give preferential treatment to a high-risk technology over every other computer system. Max Schrems, chair, noyb The Commission presents the omnibus as cutting red tape while keeping a high level of protection, and Europe’s data protection regulators said in a December 2024 opinion that legitimate interest can, case by case, cover AI models. What happens next Talks with Parliament, known as trilogues, can start once MEPs adopt their position, and the text could still change. If agreed, the rule would apply to any company processing the data of people in the EU and the wider European Economic Area, wherever the company is based. It would not change the UK’s own version of the GDPR. Why it matters The GDPR is the strictest privacy law most AI companies face, and this clause would turn the legal basis they have argued over with regulators for two years into settled law. Whether Europeans keep a firm right to say no now depends on the European Parliament. Sources: Council of the EU, Digital Omnibus mandate for negotiations, document 14756/26 PDF https://data.consilium.europa.eu/doc/document/ST-14756-2026-INIT/en/pdf ; Council of the EU press release https://www.consilium.europa.eu/en/press/press-releases/2026/10/21/digital-rulebook-council-agrees-position-to-simplify-data-protection-privacy-and-cyber-reporting-rules/ ; noyb statement https://noyb.eu/en/ai-eu-member-states-approve-digital-expropriation-europeans-ai-companies .