EU wants to allow AI training over personal data (www.euractiv.com)

A leaked draft of the European Commission’s “Digital Omnibus” revamp signals major changes that would make it easier for companies to use Europeans’ personal data to train AI. The proposal — expected in final form on 19 November — would centralize AI oversight in the Commission and explicitly allow AI developers to rely on the GDPR’s “legitimate interest” (LI) legal basis instead of seeking prior consent. It also targets cookie consent rules under the ePrivacy Directive, broadens what counts as personal data, and preserves opt-out rights but shifts defaults away from affirmative consent. Technically and politically, the shift is consequential: LI lets firms justify data use via a balancing test rather than explicit permission, and changing definitions of personal data or allowing other legal bases for cookies could reduce friction for large-scale model training and online tracking. The move mirrors recent industry practice — notably Meta’s use of user posts to train models after Ireland’s data authority cleared it — and reflects heavy lobbying from big tech and political pressure to boost EU AI competitiveness. Privacy advocates warn this hands tech companies interpretive power over the balance test and risks creating de facto carve-outs for advertising and model development, fundamentally altering consent defaults and weakening user protections across the bloc.