Overview
- The package would let companies train AI models using Europeans' data on a legitimate‑interest basis and narrow what counts as personal data under GDPR and e‑Privacy rules.
- Obligations for high‑risk AI uses would shift to December 2027 from August 2026, with proposed relief from EU database registration for narrowly or procedural‑use systems.
- Cookie consent would be simplified to reduce repetitive pop‑ups, changing how websites obtain and manage user permissions.
- Privacy groups and several MEPs warn of a major rollback of digital rights, while France, Germany and major industry players support delays and simplification.
- Commission officials argue the changes streamline overlapping rules to boost competitiveness and maintain existing privacy standards.