In short. Processing personal data collected online requires an applicable GDPR Article 6 basis, and legitimate interests requires a documented assessment of necessity and the impact on people.
Definition: A GDPR lawful basis is a condition under Article 6 of the General Data Protection Regulation that permits processing personal data for a particular purpose. Collecting personal data from websites requires an applicable basis, including when the information is publicly accessible.
Key facts
- As of 17 October 2026, GDPR Article 6 provides six bases: consent, contract, legal obligation, vital interests, public task or official authority, and legitimate interests.
- The European Data Protection Board (EDPB), in Opinion 28/2024, adopted on 17 December 2024, states that these bases have no hierarchy. Controllers must identify the appropriate basis for their processing.
- CNIL's guidance of 7 June 2024 requires a basis for AI training datasets whether data comes directly from individuals, open Internet sources, or reuse of existing collections.
What does Article 6 permit?
Personal data means information relating to an identified or identifiable person. Processing includes collection, storage and use. The controller is the organisation or person that determines the purposes and means of processing. These definitions appear in Article 4 of the GDPR.
Article 6(1) states that processing is lawful only if and to the extent that at least one of its six conditions applies.
Its alternatives have specific conditions:
- Consent covers one or more specific purposes. Article 7 requires the controller to demonstrate consent and permits withdrawal.
- Contract covers processing necessary to perform a contract with the person, or requested steps before entering one.
- Legal obligation covers processing necessary to comply with an obligation binding the controller.
- Vital interests covers processing necessary to protect someone's vital interests.
- Public task or official authority covers processing necessary for the relevant task or authority.
- Legitimate interests covers necessary processing where the controller's or a third party's interests withstand assessment against the person's interests and fundamental rights.
Article 6(3) requires the legal obligation and public task bases to be grounded in Union or Member State law. Public authorities cannot use legitimate interests for processing carried out in the performance of their tasks.
How do legitimate interests apply to web collection?
The EDPB's Opinion 28/2024 requires a documented assessment of three cumulative conditions for AI model development and deployment:
- The interest must be lawful, clearly and precisely articulated, and real and present.
- Processing must be necessary. The assessment considers less intrusive ways to pursue the interest and whether the amount of personal data is proportionate.
- The interest must withstand a balancing assessment against people's interests and fundamental rights and freedoms.
Public availability forms part of that balancing assessment. Relevant circumstances include the source website's privacy settings, the relationship with the controller, potential uses of the model, and whether people know their data is online.
For web scraping, meaning automated collection from online sources, the opinion gives examples of mitigating measures: excluding particularly sensitive sources and respecting website objections to collection for AI training, including through robots.txt. Supervisory authorities assess the measures in the circumstances of each case.
What other duties accompany the basis?
For information obtained indirectly, GDPR Article 14 requires information about the purpose, legal basis and source, subject to its exceptions. A public source is expressly covered. Article 5 also requires data minimisation, meaning limiting personal data to what is necessary for the purpose.
Article 9 adds restrictions for special categories, including health data and political opinions. Processing requires an applicable exception to its prohibition alongside an Article 6 basis. Its public-data exception concerns information manifestly made public by the person concerned.
Related terms
- GDPR transparency for web collection
- GDPR right to object
- GDPR data minimisation
- CNIL guidance on AI web scraping
FAQ
Does publishing personal data online supply consent for AI training?
Publication alone supplies no consent to that purpose. The EDPB's opinion requires controllers to identify an appropriate basis and assess the circumstances of collection and reuse.
Can you withdraw consent after collection?
Yes. GDPR Article 7(3) permits withdrawal at any time and requires withdrawal to be as easy as giving consent; earlier processing based on valid consent remains lawful.
Can you object when the controller relies on legitimate interests?
Article 21 permits an objection on grounds relating to your particular situation. The controller must stop processing unless it demonstrates overriding compelling legitimate grounds or processing serves the establishment, exercise or defence of legal claims.
Sources
- European Parliament and Council, "Regulation (EU) 2016/679", 27 April 2016
- European Data Protection Board, "Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models", 17 December 2024
- CNIL, "Ensuring the lawfulness of the data processing - Defining a legal basis", 7 June 2024
Check how a page reads to answer engines. Open the GEO score analyzer