In short. CNIL requires a lawful basis, targeted collection and safeguards when publicly accessible personal data is collected for AI development.

Definition: CNIL guidance on AI web scraping sets out conditions for collecting publicly accessible online personal data to develop AI systems. It covers the lawful basis for collection, data minimisation, website restrictions and safeguards for the people concerned.

Key facts

As of 17 October 2026, CNIL's AI system development recommendations cover system design, dataset creation and model training involving personal data.
CNIL's scraping focus sheet requires collection criteria defined in advance and deletion of irrelevant data.
CNIL's legitimate-interest guidance requires a legitimate interest, necessary processing and a balance with individuals' rights and interests.
CNIL's transparency guidance applies information duties to personal data collected indirectly, including through scraping.

What must be decided before collection?

CNIL's development recommendations begin with a purpose: a defined objective that frames which personal data training requires. They also require identifying the data controller, the organisation that determines why and how personal data is processed.

A lawful basis is the legal ground for processing personal data under the General Data Protection Regulation (GDPR). CNIL's legitimate-interest guidance explains that private bodies can use this basis when its conditions are met. Necessity requires examining whether a less intrusive approach can achieve the objective. The controller then weighs the expected benefits against effects on people, taking account of their reasonable expectations.

CNIL recommends documenting this assessment. A commercial interest can qualify, subject to lawfulness, necessity and proportionality.

Which collection measures does CNIL require?

Data minimisation means limiting collection to the personal data needed for the purpose. CNIL's scraping focus sheet identifies Article 5.1.c of the GDPR as its legal reference.

The sheet requires specific collection criteria and exclusion of unnecessary data categories through filters where possible. Where filtering is impossible, certain types of sites must be excluded. Its example is a public forum where pseudonyms are collected although only comment content is needed: irrelevant data must be deleted immediately after collection or when identified.

Websites that clearly oppose scraping for training datasets through robots.txt exclusion protocols or CAPTCHAs must also be excluded. A CAPTCHA is a test intended to distinguish human access from automated access. The sheet connects these restrictions to people's reasonable expectations.

What safeguards and information accompany scraping?

CNIL's development recommendations describe additional safeguards selected according to risk. Examples include excluding health forums by default, limiting collection to freely accessible content without account creation, and anonymising or pseudonymising data immediately after collection.

CNIL's information guidance calls for precise source information when scraping concerns a few websites. For numerous sources, it recommends categories of source sites, at least those posing the greatest risk to people. This also applies to organisations reusing scraped datasets.

Where individual notification involves disproportionate effort, the controller must assess and document that conclusion and make information publicly available. A website notice is one method; the notice must explain the processing and people's rights in clear, accessible language.

FAQ

Can I rely on public accessibility alone?

CNIL's legitimate-interest guidance treats public accessibility as one factor in reasonable expectations. The website's context, publication restrictions and relationship with the individual also matter.

Does a privacy notice always replace individual information?

CNIL's transparency guidance requires a case-by-case assessment of disproportionate effort. The volume of data alone is insufficient to establish that exception.

Sources

Check how a page reads to answer engines. Open the GEO score analyzer