France's CNIL Sets Rules for Scraping Personal Data in AI Training
On June 19, 2025, France's data protection authority CNIL published two how-to sheets targeting AI developers. One addresses legitimate interest as a legal basis for building training datasets. The second sets conditions for lawful web scraping of personal data.
The guidance, reported by www.hlc.com, acknowledges that scraping has fundamentally changed how internet data is accessed and reused. CNIL identifies significant risks to data subjects from mass collection. The authority stops short of prohibition but requires developers to assess each scraping use case individually and implement appropriate safeguards.
CNIL also recommends that lawmakers introduce dedicated legislation regulating public-authority scraping practices. Labs and operators building training pipelines in France now have clearer compliance benchmarks, but no safe harbor. The call for new legislation signals that current GDPR frameworks are straining under the weight of AI-scale data collection. Watch whether other EU member-state regulators follow with parallel guidance.