EU countries back letting AI firms use your data without asking

EU Member States have backed a change to the GDPR, Europe's main privacy law, that would let AI companies use personal data without asking for consent. The Council of the EU, which represents the member countries, approved the text on 21 October 2026 and published it the next day. It is not final law yet.

What changed

The change is part of the European Commission's 'Digital Omnibus' proposal. Its core is a new rule, Article 88bis. Under it, processing personal data in the context of AI would generally be lawful. Companies that train or use AI products, such as OpenAI, Google and Meta, would be presumed to have an overriding 'legitimate interest'. That means they would not need user consent.

Who it affects

The rule would also cover people who have never been customers of an AI company. It would reach data entered years or decades ago, such as chats and social media posts.

Member States have also proposed narrowing what counts as personal data. Several identifiers would regularly fall outside the GDPR:

• User IDs and tracking IDs
• IP addresses
• Social security numbers

Companies would largely decide whether their own data counts as personal. Most IT systems rely mainly on these identifiers, so the change would reach data-driven businesses broadly.

Why critics object

Max Schrems, an Austrian activist and lawyer, called the decision a 'digital expropriation' of Europeans. He says practices that are unlawful without consent today, including personalized advertising, could become allowed if done using AI.

The Council added references to the right to object (Article 21) and to technical safeguards (Article 24). Critics say both already apply to any processing, so they add no real protection. They also note the Commission called the package minor and used a fast-track process. As a result, no fundamental rights assessment was done, and the European expert group on data protection was not directly involved.

What happens next

The Council must still agree the final wording with the European Parliament and the Commission. Parliament has not yet adopted its position. Most members of the European People's Party tend to favor loosening digital rules. Centre-left members have pushed to keep things as they are, and far-right groups have increasingly opposed the proposals.

If the law passes, the Court of Justice of the EU could be asked whether it fits EU fundamental rights. The court has struck down EU law before in cases on data retention and on sending EU data to the US. Schrems warns that a law at high risk of being overturned would bring more legal uncertainty, not the simplification promised.