EDPB Consultation on Anonymisation and Web Scraping: What to File Before 30 October

The EDPB consultation on the anonymisation and web scraping guidelines closes on 30 October 2026, and the companies with most at stake are those already relying on de-identified datasets or on scraped training data, because the final text will become the benchmark supervisory authorities apply when those datasets are challenged.

The European Data Protection Board adopted both sets of guidelines on 7 July 2026: Guidelines 02/2026 on anonymisation and Guidelines 03/2026 on web scraping in the context of generative AI. A third set, Guidelines 04/2026 on fines and corrective powers, runs on a separate clock and closes on 13 November 2026.

1. What the anonymisation guidelines actually decide

The guidelines replace the 2014 opinion of the Article 29 Working Party and determine when data falls outside the GDPR altogether. That qualification decides whether a company has to run its entire compliance apparatus over a dataset, from legal basis through to security measures and retention.

The EDPB applies three criteria, No Record Isolation, No Linkage and No Inference, through either a contextual approach or a more cautious simplified approach. The simplified approach will treat as personal some data that is in fact anonymous. Anonymity has to be assessed from the perspective of each entity that holds the data, and reassessed periodically, because the EDPB takes the view that AI reduces the time and cost of re-identification. Three defences the market has relied on for a decade do not survive the test: a contractual prohibition on re-identification, encryption on its own, and the argument that the recipient has no motive to re-identify.

2. The test has already been applied, and it came with a clock

The Italian supervisory authority fined a major life sciences company EUR 7 million on 23 September 2026. The reasoning tracks the draft guidelines closely. Pseudonymisation is not anonymisation. A persistent hashed patient code permits longitudinal tracking, so hashing does not remove singularity. K-anonymity addresses quasi-identifiers alone, while diagnoses, prescriptions and visit patterns can single out a patient on their own.

Two features of that decision matter more than the figure. The authority gave the company 120 days to bring the database into line, which expires around 21 January 2027, and it held that if the company does not align, the general practitioners who supplied the data must anonymise it themselves. The obligation runs back to the source. A licensed European dataset can therefore be withdrawn or re-cut in the middle of a contract, on a timetable the licensee does not control, and every downstream study, model and analytics product built on it inherits that risk.

Any company that has bought, licensed or trained on a European dataset described as anonymous should read the EDPB consultation in that light, because the wording adopted in the final guidelines will govern the next decision of this kind.

3. Why the scraping guidelines reach companies that scrape nothing

Guidelines 03/2026 look like a problem for model developers. They reach considerably further. They apply where scraping is contracted out, in which case the scraper is typically a processor and the commissioning company the controller, and they apply where a company uses a dataset somebody else scraped, because whoever re-uses the data is responsible for its own processing and has to demonstrate compliance.

The EDPB treats legitimate interest as the reference legal basis, regards consent as generally unworkable at scale, and requires granular minimisation and mitigation: respecting robots.txt and CAPTCHA, excluding defined categories of websites, and filtering outputs so that special categories of personal data are not surfaced. Those requirements land directly in supplier contracts, in dataset due diligence and in the warranties a buyer should be asking for. The open questions these guidelines leave unresolved were set out in this earlier analysis.

4. What a submission to the EDPB consultation should argue

Guidelines 02/2026, anonymisation

• Who should file: pharma, health analytics, insurers, clinical research networks, data brokers, and AI developers training on European data.
• What to argue: that singularity be assessed against a realistic re-identification risk rather than a theoretical one, and that technical and contractual foreclosure be weighted inside the test rather than excluded from it.
• Evidence that lands: the cost and skill actually required to re-identify a specific production dataset with its controls in place, rather than a general statement about method.

Guidelines 03/2026, web scraping

• Who should file: model developers, publishers, user-generated content platforms, marketplaces, and any company licensing a third-party corpus.
• What to argue: that the mitigation list be workable at production scale, and that the position of a re-user who did not perform the collection be distinguished from that of the original scraper.
• Evidence that lands: the contract architecture already running between commissioning company, scraper and licensee, and the specific points at which the required checks cannot be performed.

Guidelines 04/2026, fines and corrective powers

• Who should file: telecoms, utilities, large retail and multi-entity groups.
• What to argue: the perimeter of the undertaking whose turnover sets the ceiling, and the weight of non-monetary corrective measures against the fine itself.
• Evidence that lands: group structures in which the controller is a subsidiary with no control over the processing decision.

A submission that describes operational reality carries further than one that restates the law back to the authority. The EDPB drafts without access to production systems, and the gap between a requirement as written and a requirement as implemented is the contribution a company is uniquely able to make.

5. Actions before 30 October

1. Identify every dataset held, licensed or sold under the description “anonymous” or “de-identified”, and record which entity made that assessment and when.
2. Apply the three criteria to the two or three datasets carrying the most commercial weight, and treat a failure as a finding to raise in the EDPB consultation rather than as a compliance gap to close quietly.
3. Review licence agreements for what happens if a supervisory authority orders the source to re-cut the data, which is the scenario the IQVIA decision has now made concrete, and check whether the warranty, the indemnity and the termination right cover it.
4. Map which supplier contracts involve scraping performed by a third party, and establish who currently warrants compliance with robots.txt, site exclusions and output filtering.
5. Decide whether to file alone or through a trade association. A co-signed submission carries more weight with the EDPB, and it also removes the concern about identifying a company’s own exposure in a public document.
6. Diarise 13 November separately for Guidelines 04/2026, which most companies will otherwise miss.

The enforcement side of these questions is already moving faster than the guidance. Italy has an inspection programme running through the second half of 2026 with a binding deadline on 29 October, and from 23 October a single agency holds market surveillance powers over AI systems, with inspections without prior notice. Companies that wait for the final guidelines will meet them first in an inspection file, and by then the wording will be settled.