AI training and cookie rules in the EU Digital Omnibus

The permanent representatives of EU member states agreed the Council of the EU's position on the draft Digital Omnibus on 21 October, a proposal the European Commission put forward in November 2025. Under the Council's position, the EU's General Data Protection Regulation (GDPR) would state that personal data may be processed to develop and operate AI on the basis of "legitimate interest", a legal basis that needs no prior consent but requires weighing the rights of the people concerned. The Council document is titled a mandate for negotiations with the European Parliament, so it is not the final law, and as of 23 October the Parliament's procedure page still read "Awaiting committee decision". The GDPR applies to personal data processed by businesses established in the EU, and also protects people in the EU who are offered services or whose behaviour is monitored by businesses outside it; otherwise, readers outside the EU are not directly affected.

Under Article 88bis of the Council's text, personal data may be processed under the GDPR's legitimate interest when developing and operating an AI system or model, with technical and organisational safeguards. The Commission's proposal listed data minimisation, enhanced transparency and an "unconditional right to object" in the article itself, and excluded cases where the rights of the people concerned override. The Council removed enhanced transparency and the overriding-rights exception from the article, and replaced the right to object with the one in Article 21 of the GDPR, which has to be based on a person's particular situation. Data minimisation and the overriding-rights balance moved to a recital (an explanatory passage before the articles that is not itself binding), and according to the same recital, developing or operating AI does not in itself constitute a legitimate interest and has to be assessed case by case.

The Commission had proposed changing the definition of personal data in Article 4(1) of the GDPR. In February the European Data Protection Board (EDPB, made up of national data protection authorities) and the European Data Protection Supervisor (EDPS, which oversees the EU institutions' own handling of personal data) strongly urged lawmakers not to adopt it, and the Council dropped the change. The Council added a new Article 25a, under which pseudonymised data (data in which fields that directly identify a person are replaced with codes) is not personal data for a third party that cannot identify the person.

The Commission had proposed moving the cookie rules into the GDPR, but the Council kept them in the ePrivacy Directive, which governs privacy in electronic communications, and widened the cases where no user consent is needed. The new cases include showing ads and measuring their performance based only on the content of the page being viewed, without using personal data. Under the Council's version, a site may not ask again for the same purpose for at least four months after a user refuses. The Commission's proposal set the period at six months, so under the Council's version sites can ask again sooner.

In a June letter to member state representatives, the consumer organisation BEUC supported letting browsers send consent or refusal signals automatically, and the Council did not keep that design.

Perspective

If the Council's version becomes the final law, companies could point to the article to claim legitimate interest for using personal data to develop AI, and more cookies would need no consent. The LinkedIn and Gemini settings covered further down have nothing to do with this bill and were already available as of 23 October.

Legitimate interest is one of the six legal bases in the GDPR, under which a company does not need prior consent but has to show the processing is necessary and weigh it against the rights of the people concerned. According to an EDPB opinion of December 2024, legitimate interest can in some cases be the legal basis for developing and deploying AI models. Under Article 21 of the GDPR, a person can object on grounds relating to their particular situation, and the company can continue only if it shows compelling legitimate grounds that override.

According to the explanatory memorandum to the Commission's proposal, one aim of the changes is to clarify some rules on processing data for AI training and development. Industry groups, in a letter to the Council in September on the compromise text of the time (the letter itself is undated), asked for the legal basis to be written into the articles themselves, because a recital alone would not give businesses certainty. In its October mandate, the Council placed Article 88bis in the articles themselves. In their joint opinion on the Commission's proposal in February, the EDPB and the EDPS concluded that the GDPR does not need a separate article for this, and that companies would still have to pass the same case-by-case assessment.

As of 23 October, the only public response to the text agreed in October that we found came from noyb, an Austrian privacy advocacy group. In noyb's reading of 23 October, the agreed text makes processing "in the context of AI" automatically lawful, which noyb calls a "digital expropriation" of Europeans. In a letter of 18 September on the compromise text of the time, EDRi, a coalition of European digital rights groups, wrote that the article does not make all AI-related processing automatically lawful but risks turning a case-by-case assessment into a broad legislative endorsement. In the Council's recital, developing AI does not in itself constitute a legitimate interest, and according to the Council's press release (as republished), appropriate safeguards are maintained alongside support for AI innovation.

According to the Council's press release, the definition is unchanged and the new pseudonymisation provision aims to clarify compliance requirements for organisations. noyb regards it as drastically narrowing what counts as personal data, which makes it unclear whether online tracking would still be covered by the GDPR. Under another paragraph of Article 25a, when data is passed to a third party that can identify the person, both the transfer and the later processing still count as processing personal data. According to EDRi's letter, the same pseudonymised data may be non-personal for some organisations and personal for others.

When processing relies on legitimate interest, people in the EU can object under Article 21. According to Meta's announcement of April 2025, EU users can also object through a form to their public data being used for training, and the announcement does not name the article this relies on.

As of 23 October, the generative AI training setting on LinkedIn's help page is on by default, turning it off stops only future training, and no regional limit appears on the page. According to Google's help page, checked the same day, turning off Gemini's Keep Activity and not submitting feedback keeps future chats out of AI model improvement. According to the same page, these settings do not cover using chats to produce anonymised data for improving services. Chats are still kept for 72 hours after the setting is turned off, to respond to users and protect Google, users and the public, and may be reviewed by people during that time.

We, a community based in Taiwan, compared South Korea, Japan and Taiwan on when personal data can be used for AI training without consent, and did not check the rights to object or refuse in South Korea and Japan. According to guidance the South Korean Personal Information Protection Commission (PIPC) published on 6 August 2025, building on its July 2024 guidance on publicly available personal information, the legal basis that can realistically be considered for collecting public personal information from the web is the legitimate interest clause in Article 15(1)6 of the Personal Information Protection Act. Under the guidance, the purpose has to be legitimate, the processing necessary, and the company's legitimate interest has to clearly override the rights of the people concerned, a threshold that also appears in the statutory clause itself. Under Article 6(1)(f) of the GDPR, processing is allowed unless the interests of the people concerned override the company's, so the Korean clause puts a higher bar on the company (our comparison).

The National Assembly passed an amendment on 20 August 2026 that adds a separate route, alongside existing legal bases, under which lawfully collected personal information can be used for AI development where pseudonymised or anonymised data is not enough and there is a public or social need, with stronger safeguards and prior deliberation and resolution by the PIPC. It takes effect six months after promulgation, so it cannot take effect before February 2027. Article 88bis in the Council's text has no comparable prior review by a regulator, and Korea's existing legitimate interest clause has none either, so the comparison is with the new special route (our comparison).

Under Japan's Act on the Protection of Personal Information, as of 23 October consent is required, outside its exceptions, to acquire sensitive personal information such as creed, medical history or criminal record and to provide personal data to third parties. Once an amendment promulgated on 17 July 2026 takes effect, consent would no longer be needed to provide personal data to third parties or to acquire sensitive information that has been made public when the data is used only to produce statistical information, which covers AI development that can be classed as producing statistics. The conditions include publishing who is involved and what they intend to do, a written agreement between the provider and the recipient, and a ban on other uses and onward provision. The amendment takes effect in principle within two years of promulgation, and as of 23 October no date appears on the page of the Personal Information Protection Commission (PPC) and the implementing orders and rules are still under consideration, so we take it as not yet in force.

Taiwan's Personal Data Protection Act has no provision on AI training as of 23 October. Under Article 19, a non-government entity with a specific purpose may collect data from generally available sources without consent, except for the medical, genetic and other data listed in Article 6, or where the person has a clearly greater interest to protect. Under Article 20, using data, which includes using it for training, must stay within the specific purpose of collection, and under Article 3, people can ask for collection, processing or use to stop and for their data to be deleted. Under Article 14 of the AI Basic Act, promulgated in January 2026, the authorities in charge of each sector are to work with the personal data protection authority to avoid unnecessary collection, processing or use of personal data in AI research and applications.

Readers can compare the version the European Parliament eventually forms with the Council's using a few questions. First, once legitimate interest is written into the article, do companies gain more certainty, and do data protection authorities still review case by case. Second, can people actually use the right to object, and would the new pseudonymisation rule take online tracking outside the GDPR. Third, would people see fewer cookie consent banners, one of the effects the Commission's proposal set out to achieve.