The European Commission is planning to soften some of the EU’s strict digital privacy rules. This move could change how websites track visitors and how companies train AI systems using personal data. Privacy advocates warn that these changes might weaken the protections that keep user data safe, but the Commission argues they will make compliance easier and boost innovation.

What’s Changing with Cookie Rules?

Right now, websites in the EU must ask users directly for permission before placing cookies that aren’t essential for their basic function. This is called an opt-in system. But the new proposal might switch to an opt-out system, meaning cookies could be set by default, and users would have to actively refuse them if they don’t want to be tracked. This shift could make it easier for companies to gather data, but it could also reduce user control over their privacy.

The draft suggests moving cookie regulation from the ePrivacy Directive into the GDPR itself, creating a new article called 88a. This change would allow websites to process some data based on a limited list of low-risk purposes or on “legitimate interests” under GDPR, rather than requiring explicit user consent. Critics say this could lead to less transparency and more tracking without clear user approval.

There’s also talk of automatic transmission of user preferences by browsers or operating systems, which might replace the current cookie banners. However, news organizations could still require explicit consent, arguing that it’s essential for journalism’s economic survival. Privacy groups see this as a way to weaken protections that were put in place to keep users safe from constant tracking.

AI Training and Privacy Concerns

Another big change relates to how companies can use personal data to train AI systems. The draft suggests that AI training, testing, and validation could be done under the “legitimate interest” basis, as long as companies follow rules like minimizing data use, being transparent, and allowing users to object.

This is a hot topic because it could let companies collect and use personal data for AI development without asking for explicit consent first. Privacy experts warn that this could lead to large-scale data mining and processing that violates the original intent of GDPR. The draft also proposes a limited exemption for sensitive data that accidentally appears in datasets, allowing companies to keep it if removing it would be too difficult.

The proposal emphasizes that AI training should be “beneficial for the data subject and society,” citing bias detection and accuracy as examples. Still, critics worry that labeling AI training as a “legitimate interest” could open the door to more unchecked data collection, potentially putting privacy at risk.

Changes to Sensitive Data Protections

The draft also suggests narrowing the definition of what counts as sensitive data under GDPR. Currently, data that directly reveals things like race, religion, or health gets extra protection. The new plan would only apply stronger protections when the data explicitly shows these traits. It would not cover data that only hints at such characteristics through analysis or inference.

This change worries privacy advocates because it could allow companies to analyze neutral data—like social media activity or browsing habits—and infer sensitive traits without triggering higher legal safeguards. Critics say this could lead to increased risks of discrimination or misuse of personal information.

Some organizations, like the European Law Institute, acknowledge that updates are needed but warn that any weakening of data protections should not come at the expense of fundamental rights. Privacy groups, meanwhile, argue that the proposed changes seem aimed more at benefiting industry than safeguarding individuals.

In summary, the EU’s upcoming revisions could make it easier for companies to track users and use personal data for AI, but these moves raise serious privacy concerns. As the proposal gets closer to its formal unveiling, many are watching closely to see whether the balance between innovation and rights will shift in favor of the latter.

Inspired by

• https://www.computerworld.com/article/4087347/european-commission-moves-to-loosen-gdpr-for-ai-and-cookie-tracking.html

Sources

• gmpg.org
• shutterstock.com
• netzpolitik.org
• netzpolitik.org
• edri.org