EDPB sheds light on anonymisation and web scraping for generative AI and adopts final version of guidelines on blockchain

The new EDPB guidelines bring clarity to the notion of anonymous data, taking also into account the ruling of the Court of Justice of the EU in the case C-413/23 P EDPS v SRB of 4 September 2025 and other CJEU jurisprudence. The simplified approach can go beyond the legal standard and may lead an anonymising controller to treat data as though it is not anonymous even if it would actually be so for some relevant entities, but this approach can be more convenient, and provide greater confidence that data is actually anonymous. In its guidelineson web scraping in the context of generative AI*, the Board clarifies various aspects of the GDPR compliance of web scraping, including the legal basis for such activities and the conditions under which special categories of data can be processed in this context. The EDPB suggests that the Court ruling in GC & Others (C-136/17) may be relevant for incidental or residual collection of special categories of personal data, provided the controller acts within the ”framework of their responsibilities, powers, and capabilities” and implements appropriate technical and organisational measures to prevent the collection and dissemination of such data. The guidelines will be subject to public consultation until 30 October 2026, providing stakeholders with the opportunity to and provide feedback Following public consultation, the EDPB has adopted the final version of its guidelines on blockchain technologies. In line with the Helsinki statement’s objective to strengthen the dialogue with stakeholders, the Board has also released a report on the outcome of the dedicated public consultation, as well as a track changes version of the guidelines.Note to editors: *Generative AI is a technology aiming to create new content by learning patterns from existing data.