EU Member States have approved a GDPR change that would let companies such as OpenAI, Google, and Meta process personal data for AI.
nyob reports that the Council of the EU, which represents the Member States, approved the text on 21 October 2026, and the document was published the following day. The amendment is part of the European Commission’s ‘Digital Omnibus’ proposal. Its central element is a new provision, first proposed as Article 88c and now numbered Article 88bis in the Council document. Under the approved wording, processing personal data in the context of AI would generally be lawful. Companies using or training AI products would be presumed to have an overriding ‘legitimate interest’, so they would not need user consent. The provision would also cover people who have never been customers of an AI company, and data entered years or decades ago, such as chats and social media posts. Max Schrems, an Austrian activist and lawyer, criticised the decision and called it a ‘digital expropriation’ of Europeans.
From simplification to a broad legal basis
The Commission had presented the Digital Omnibus as a set of minor changes meant to simplify rules for EU companies while keeping a ‘high level of protection’ for individuals. On that basis, it chose a fast-track procedure. According to the announcement, this meant no fundamental rights assessment was carried out, and that the European expert group on data protection was not directly involved. The file is now with the Council under the Irish Presidency. Ireland is also where most US and China-based AI companies have their EU headquarters. Germany and other Member States supported the approved text.
The Council added references to two existing GDPR provisions. Article 21 gives individuals a right to object in specific cases, and Article 24 requires technical and organisational measures to implement legal obligations. Critics note that both duties would apply to any processing anyway, so the new article adds no material safeguards.
The GDPR currently allows processing for defined purposes, such as keeping tax records or preventing fraud. Article 88bis would instead legitimise processing linked to a technology, regardless of the purpose. Schrems said that practices currently unlawful without consent, including personalised advertising, could become permissible if carried out using AI.
Pseudonymised data and competitive concerns
Member States have also proposed narrowing the definition of personal data. Under this change, pseudonyms such as user IDs, tracking IDs, IP addresses, and social security numbers would regularly fall outside the GDPR. It could then be unclear whether online tracking is still covered, and the companies subject to the law would largely decide whether their data counts as personal. Most IT systems rely mainly on pseudonymous identifiers, so the change would affect data-driven businesses broadly.
Critics also question the industrial policy case. They argue that most EU companies lack the data volumes and capital to compete with US corporations. In their view, data collected by EU firms but processed on platforms outside the EU could flow to providers in the US or China, and know-how could follow.
Next steps in the trilogue
The Council’s position is not the final law. The Council must still negotiate the final wording with the European Parliament, which has yet to adopt its position, and with the Commission in trilogue talks. In Parliament, most members of the European People’s Party (EPP) have tended to favour loosening EU digital rules, nyob reports. Centre-left MEPs have so far pushed to keep the status quo, and far-right groups have increasingly opposed the proposals.
If the law is adopted, the Court of Justice of the EU could be asked whether it is compatible with EU fundamental rights. The court has previously struck down EU law in cases involving data retention and transfers of EU data to the US. Max Schrems warned that a law at high risk of being overturned would create more legal uncertainty rather than the promised simplification.
