Your Old Posts Could Soon Train AI — Without Anyone Asking You

On 21 October 2026, the governments of the European Union’s 27 member states agreed on a change that could quietly rewrite who controls your digital past. Under the proposal, AI companies would be allowed to use your personal data to build and run their systems — without ever asking your permission.

What actually happened?

Ambassadors from all 27 member states, meeting as the Permanent Representatives Committee (Coreper), agreed the Council’s position on the data-protection part of the “Digital Omnibus” package. The text was published the following day.

The Digital Omnibus is a package of changes the European Commission first proposed in November 2025, presented as a simplification of the EU’s privacy rules for businesses. At the heart of the package sits a new clause, originally proposed as Article 88c and renumbered Article 88bis by the Council.

It says that processing personal data “in the context of the development and operation of an AI system or of an AI model” may be carried out on the basis of a company’s “legitimate interest”.

Consent vs. legitimate interest — what’s the difference?

Under the GDPR, companies need one of six legal grounds to use your data. Consent is the best-known: you say yes, and you can take it back. Legitimate interest is different. The company weighs its own interest against your rights and decides for itself — no yes from you is required.

This is not entirely new ground. Meta already relied on legitimate interest when it began training its AI models on adults’ public Facebook and Instagram posts in the EU in May 2025. Writing the same footing into the law would hand it to every AI developer, not just the biggest platforms.

What would it mean for ordinary people?

The scope is what worries privacy campaigners most. The clause would cover people who have never used an AI company’s services, and data shared years or even decades ago — old messages, social posts and photos that you have long forgotten about.

The original Commission proposal included an unconditional right to object to AI use of your data. The Council’s text removed that right from the operative part of the law. It now appears only in a recital, as one factor companies should consider. Recitals guide interpretation, but they do not create rights on their own.

Why is it so controversial?

The Austrian privacy group noyb, led by Max Schrems, has called the move the “digital expropriation” of Europeans. Schrems argues that Google, Meta and Microsoft could use nearly everything they have collected over the years, for almost any project with an AI component — and he has described it as the biggest gift EU member states have ever made to US Big Tech.

Supporters of the package say it simply cuts red tape and keeps Europe competitive in AI, while maintaining a “high level of protection” for individuals. Critics reply that the file was fast-tracked without a fundamental rights assessment, and they note that Ireland — which holds the Council presidency and hosts the EU headquarters of most US and Chinese AI companies — has backed the text.

So is this the law now? No — and that matters

That means the story is far from over. Parliament could restore the unconditional right to object, narrow the scope, or reject the clause altogether. For now, the safest reading is this: the direction of travel is clear, but the final rules are not written.

What does it mean for your business?

If your website serves visitors from the EU, do not change your privacy practices yet. Consent-based data handling remains the safe default until a final law exists. But this is a file worth watching, because it could reshape how every business that uses AI treats customer data.

The question now is not whether AI will use personal data, but on whose terms. The answer will be decided in the months ahead — in Parliament, in negotiations, and possibly in court.