A fresh leak from the EU Council is rewriting two debates at once: how personal data can legally feed AI training, and where cookie consent rules should live. Privacy group noyb has published restricted Council documents showing the Irish Presidency removed the unconditional opt-out from the proposed GDPR AI clause and shifted device-access consent back into the ePrivacy Directive.
The 158-page compromise, dated 3 September 2026 and classified LIMITE, is not final. But it shows where governments are pushing before talks with the European Parliament.
What changes in the AI clause
The Commission’s AI provision, originally Article 88c, becomes Article 88 bis in the Presidency text. Its core sentence would allow personal data processing for the development and operation of an AI system or model on the basis of legitimate interest under Article 6(1)(f). A controller would still need to choose an appropriate legal ground and apply technical and organisational safeguards.
What has been cut matters more. The Commission’s conditions and example safeguards are struck from the operative article: the where appropriate qualifier, consent carve-outs under other laws, the child-specific override, data minimisation, enhanced transparency and the unconditional right to object are all gone.
The balancing test does not disappear, because Article 6(1)(f) already requires it. But the AI-specific protections would no longer appear on the face of the binding provision. A new recital keeps some language in softer, non-binding form.
Germany wants a stronger presumption
A separate German working document goes further. Berlin proposes a legal presumption that training and technical operation of an AI system or model is a legitimate interest, and removes the national consent carve-out so that only Union law could still demand consent. It would also relax access, rectification and erasure rights where compliance is impossible or involves disproportionate effort.
noyb calls the Presidency draft extreme
and the German paper a proposal for massive liberalization
. Max Schrems described the direction as nothing but a digital expropriation of Europeans
, according to noyb.
Cookie consent moves back to ePrivacy
The same Council text deletes the proposed GDPR articles on device-access consent and browser signals. Instead, Article 5(3) of the ePrivacy Directive gets a rewrite. Consent remains the default for storing or reading information on a device, but the draft lists six consent-exempt purposes.
A new sixth ground would allow measurement of contextual advertising that is based solely on the immediate content or a single search query. The exemption is narrow: no profiling, no data retention, and no link with past or future activity. Yet a recital names capping cookies as covered, while the operative text excludes any link to past activity—something frequency capping typically requires. Regulators will likely need to clarify that mismatch.
Consent mechanics also survive. Users must be able to refuse with one click, and a provider cannot ask again for the same purpose for at least six months. That would become a statutory design requirement for every consent management platform serving EU users.
Why marketers should pay attention
This is not theoretical. Meta said it would begin processing EU users’ data for AI training under legitimate interest from 27 May 2025, and noyb sent a cease and desist letter on 14 May. A later survey found only 7% of users wanted their data used that way. The European Data Protection Board has also found that controllers routinely underestimate what the balancing test requires.
For marketers, the practical takeaway is simple: a legitimate-interest basis is not a free pass. If the draft becomes law, the quality of your documented balancing test may be the main protection left.
What to do now
- Audit AI and measurement workflows that touch EU personal data and map the lawful basis for each processing activity.
- Run a documented balancing test before relying on legitimate interest: is the purpose specific, necessary and proportionate, and do user rights override it?
- Review consent management flows for device access—single-click refusal and the six-month rule would become hard requirements.
- Treat contextual measurement as a narrow exemption, not a general cookie bypass, and monitor how regulators interpret capping.
Source: PPC Land
