Overview
- Draft documents propose expanding the GDPR’s ‘legitimate interest’ legal basis, shifting more data processing away from prior consent.
- The package would relax current opt‑in rules for non‑essential cookies, moving to opt‑out with browser or OS signals conveying user preferences.
- Media sites would be exempt from automatically honoring those machine‑readable preference signals to protect advertising revenue.
- AI developers would be allowed to train models on more user data under ‘legitimate interest’ as Article 9’s scope is narrowed to data that directly reveals sensitive attributes, with biometric and genetic data retaining strict protection.
- The drafts also point to centralizing AI oversight in an EU AI Office, and early reactions show member‑state splits and sharp criticism from privacy advocates including GDPR architect Paul Nemitz.