Overview
- Draft proposals would let AI companies rely on legitimate interest to use personal data and permit processing of some special‑category data for training and operation.
- Redefinitions would narrow what counts as personal or special‑category data and merge parts of the ePrivacy cookie regime into the GDPR.
- Transitional measures include exemptions from registering narrowly used high‑risk systems, a one‑year window before penalties apply until Aug. 2, 2027, and a grace period for AI‑output labelling.
- Privacy groups including noyb and EDRi condemn the plan as a 'death by a thousand cuts' to GDPR safeguards and warn about broader access to users’ devices.
- EU capitals and lawmakers are divided, with Estonia, France, Austria and Slovenia opposing changes as Germany seeks major revisions, and the draft must still be negotiated before any implementation.