Overview
- Draft proposals would allow non‑essential cookies to rely on legitimate interest rather than prior opt‑in, moving many sites to an opt‑out model and adding machine‑readable preference signals with an exception for media outlets.
- AI developers would be able to train and operate systems using personal and some indirectly sensitive data under legitimate interest as Article 9’s higher protections are narrowed to information that directly reveals sensitive traits, while biometric and genetic data remain strictly protected.
- The texts outline a redefinition that could exclude some pseudonymised data from full GDPR safeguards by focusing on whether a controller can identify a person, raising re‑identification concerns.
- Privacy advocates including Max Schrems and former Commission director Paul Nemitz condemn the drafts as a major rollback of rights and warn of legal uncertainty around undefined safeguards and opt‑out mechanisms.
- Member‑state positions appear split, with Germany reported as supportive and Estonia, France, Austria and Slovenia opposed, and the Commission is expected to formally present the package around November 19, with details still subject to change.