EDPB Web Scraping Guidelines Put Data Minimization and Transparency in Focus

The European Data Protection Board has opened Guidelines 03/2026 on web scraping in the context of generative AI for public consultation. Adopted on 7 July 2026, the draft is open for feedback until 30 October 2026. For teams that use automated collection, browsers and regional proxy infrastructure, the operational message is clear: network access is only one layer of a compliant data program.

What the guidelines cover

The document focuses on private organisations that scrape internet sources themselves, contract another party to collect data, or reuse previously scraped datasets for generative-AI development. It distinguishes targeted collection from unrestricted crawling and describes the full lifecycle: defining collection criteria, extraction, cleaning, structuring and storage.

The EDPB notes that the GDPR applies when those stages process personal data. Responsibility cannot be reduced to the component that sends HTTP requests. Controllers, processors and possible joint controllers must be assessed according to the actual purpose, instructions and influence over the processing.

Four operational priorities

1. Define a precise purpose before collection

A team should be able to explain why each source and field is necessary for a specific, lawful objective. A broad instruction such as “collect everything available” makes it difficult to demonstrate purpose limitation or necessity. Collection criteria should be documented before workers, queues or proxy sessions are configured.

2. Minimise data at the source

The draft recommends measures such as precise inclusion criteria, data mapping, filters that exclude unnecessary categories, and excluding sources that structurally contain data the project does not need. It also discusses avoiding sites that clearly oppose scraping. Filtering after storage is useful, but it is not a substitute for preventing unnecessary collection.

3. Build transparency into the system

Where individual notice is impossible or disproportionate, the guidelines discuss making required information publicly available. That can include the categories and purposes of processing, legal basis, source types, collection periods and crawler characteristics. Teams therefore need a versioned record of which collectors ran, when, against which approved source set and under which policy.

4. Preserve accuracy and accountability

Reliable sources, timestamps and validation steps help prevent stale or incorrect records from flowing into downstream datasets. Accountability also requires evidence: configuration history, exclusion lists, field-level filters, retention rules, access controls and deletion or anonymisation events.

Why proxy configuration belongs in the audit trail

A proxy service does not determine whether a collection purpose is lawful, but its configuration can affect accountability. Region selection, session duration, concurrency and retry behaviour should map to an approved job rather than exist as undocumented global defaults.

Record a job identifier, authorised region, session policy, rate limit and completion result. Keep cookies and storage isolated between independent tasks. If a retry changes the exit identity, log the boundary. These controls make failures explainable and help teams show that rotation was used for reliability or regional verification—not to evade a site’s restrictions.

A practical review checklist

• Write the business purpose and lawful basis before collection begins.
• Maintain an allowlist of approved source categories and an exclusion process.
• Detect and exclude fields that are not necessary for the stated purpose.
• Respect robots directives, access controls, contractual terms and clear objections.
• Use conservative concurrency, request spacing and bounded retries.
• Timestamp records and preserve provenance without retaining unnecessary identifiers.
• Define retention, deletion, anonymisation and rights-handling procedures.
• Review vendors according to their factual role, instructions and security controls.
• Test the entire pipeline on synthetic or non-personal data where feasible.

What buyers should ask a proxy provider

Data teams should ask whether session controls are explicit, whether region and exit changes can be observed, how credentials are isolated, and what usage safeguards exist. They should also confirm that operational logs support their own accountability requirements without collecting more personal data than necessary.

For authorised regional testing, teams can compare dynamic residential proxy options and static residential proxy options, then choose a session model that matches the approved workflow.

What happens next

The document is a public-consultation draft, not a shortcut to legal advice. Organisations should track the final text, document assumptions and involve qualified privacy counsel for high-risk processing. The strongest immediate action is to connect collection policy with technical enforcement: fewer sources, fewer fields, clearer provenance and measurable controls.

Research note

This update is based on the European Data Protection Board, Guidelines 03/2026 on web scraping in the context of generative AI, Version 1.0, adopted 7 July 2026, and the public consultation open from 8 July to 30 October 2026. Source names and dates are provided as plain text under 98IP’s zero-external-link policy.