European Commission proposes GDPR relief for AI and cookie tracking

Integrity groups warn that the changes could erode fundamental protections, while the Commission says they will simplify compliance and support innovation.

The EU wants to modernize GDPR – but risks weakening privacy protection

The European Commission is preparing a comprehensive revision of the General Data Protection Regulation (GDPR) that could change how companies handle personal data – from cookie tracking to AI training. The proposal, which is expected to be presented on November 19, has already sparked strong reactions from privacy advocates who warn that it could erode the EU’s privacy framework.

According to a leaked draft reported by the German organization Netzpolitik.org The Commission plans to include the changes in a new “Digital Omnibus Package.” It would, among other things, remove the requirement for websites to obtain explicit consent before placing cookies, as well as allow the use of personal data for AI training when justified by a company’s “legitimate interest.”.

Cookies are moved under GDPR – less consent required

The proposal for a new article, 88a, which covers “processing of personal data on and from terminal equipment”. This means in practice that the regulation of cookies is moved from the ePrivacy Directive to GDPR.

I dag kräver artikel 5(3) i ePrivacy-direktivet uttryckligt samtycke för alla icke-nödvändiga cookies. Kommissionen menar att detta skapat onödig komplexitet och högre efterlevnadskostnader. Med det nya förslaget skulle företag kunna behandla data via cookies baserat på en lista över “lågriskändamål” eller på rättslig grund som berättigat intresse – vilket innebär att spårning kan ske som standard, med möjlighet för användare att invända i efterhand.

”While consent is required to ensure control, it is not always the most appropriate basis for processing,” the draft states.

However, privacy organizations believe that this risks being a setback for European data protection. European Digital Rights (EDRi) wrote in October:

“GDPR, ePrivacy and the AI Act are not barriers to innovation – they are the foundation of Europe’s human-centric digital model. The Commission now seems poised to weaken ePrivacy protections.”

Exceptions for media and AI training

The proposal makes an exception for the media industry. News organizations will continue to be able to require consent for cookies, citing the need to protect the economic foundation of journalism.

At the same time, you get AI training green light. The draft proposes that companies should be able to train, test and validate AI systems with personal data based on legitimate interest – as long as they put in place safeguards such as data minimisation, transparency and a right to object. The Commission cites examples such as detecting bias or improving the accuracy of models.

But privacy lawyers warn that this change could open the door to widespread data mining without consent, something GDPR was originally created to prevent.

Limitation of protection for sensitive data

One of the most controversial elements is the proposed limitation of what counts as sensitive personal data under Article 9. Only data that directly reveals sensitive characteristics, such as religion or health, would be covered. Information that is only indicates these via analysis or profiling would no longer have the same protection.

Critics say this could allow companies to draw conclusions about political opinions or sexual orientation without this information being shared. protected.

European Law Institute warned in his feedback on October 14:

“Improvements must not come at the expense of protecting fundamental rights.”

What happens next?

If the proposal goes through, companies across the EU would be spared from having to rely on comprehensive cookie consent systems and instead would have to document their legal basis under legitimate interest. Privacy groups have warned that the consultation was “exclusionary” and focused on “industry voices”.

The revision could thus be a turning point for Europe's data protection – either towards more flexible regulation that favors innovation, or towards weakened privacy protection for millions of users.