Anonymisation and generative AI: the EDPB consultation closes today

The European Data Protection Board opened consultation on two texts defining what software may call anonymous data and what it may scrape to train AI. Consultation closes this October 30.

The public consultation by the European Data Protection Board, known as the EDPB in English and CEPD in French, on its guidelines for anonymisation and scraping for generative AI closes today, October 30, 2026. Both texts were adopted on July 7, 2026, according to the CNIL page dedicated to them.

What the text calls anonymous data

The definition adopted by the EDPB is short: 'Data is anonymous if it does not relate to an identified or identifiable natural person.' The guidelines propose three criteria for checking this, quoted by the CNIL: no singling out of records, no linkability, and no inference. In your software, this means that a database does not become anonymous simply because you removed the names. If a row can be linked to someone because they were the only person who ordered that day, if two tables can be cross-referenced, or if their identity can be inferred from the remaining information, the data is still personal and the regulation applies. Take a customer file from which you removed names and email addresses: if a postcode, first-order date, and amount remain, the person living alone in that postcode can be found within minutes. The file looks anonymous, but it is not anonymous under the definition.

Scraping, named and framed

The second text concerns what the CNIL describes as 'an automated process for extracting data at scale that often operates without individuals being aware of it'. The EDPB recommends paying attention to the principles of purpose limitation and transparency. Two simple ideas lie behind those terms: data is collected for an announced use, and the people concerned must be able to know that their data was taken. The question first concerns those training models, then extends to any team feeding a tool with data collected outside its own organisation: a business directory scraped to feed a recommendation engine, customer reviews retrieved from a marketplace, or public profiles collected for a prospecting tool.

Why owners having software built are affected

The issue leaves the laboratory as soon as an AI feature connects to your customer, patient, or member database. Three decisions then belong to you, and the requirements document is the right place to record them: which data goes to an AI service, in what form, and who is allowed to read it. Writing 'the data is anonymised' in a contract is no longer enough when the European definition requires all three criteria to be demonstrated. We have covered this from the responsibility perspective, when an agent team works on your data, and from the perspective of information owed to users when your software must say it is AI.

What CNIL already wrote about agents

On July 20, 2026, the CNIL and the Conseil de l'IA et du Numérique published an exploratory note on AI systems capable of acting on their environment on a user's behalf. It highlights the movement of personal data among numerous services and the loss of control over that data, noting that these flows can be difficult for users to understand. The note also identifies the systems' greater decision-making autonomy and persistent memories, which build highly personalised profiles. Its conclusion is that the existing legal framework applies, while adaptation is needed. It contains no figures and introduces no new obligations. It is an exploratory text to be read as an announcement of work to come.

What the construction tool changes

When several agents work in sequence on a project, the first question is where the files go. With Maestro, code and documents stay on your Mac, online backup to your own account is a choice you make, and no server on our side sees your projects. Access keys live in macOS Keychain. This settles the files' route without settling the underlying issue: your customers' data remains yours, and compliance in how you use it remains your responsibility. The details of what leaves your machine are published line by line.

In practice

This week, make a list of the personal data your software retains: names, addresses, file numbers, purchase histories, and free-text notes. For each line, write what it is used for and who reads it. This document fits on one page, can be reviewed with your legal adviser, and is worth more than an audit after the fact. The EDPB guidelines are not final, and this article is not legal advice: check your circumstances with your adviser.