The EU Council, the body representing EU member state governments has approved a position that would let companies train AI on Europeans’ personal data without consent. It would make AI training a recognised “legitimate interest” under GDPR one of the legal bases companies can use to process personal data without asking for permission under the current framework, AI training on personal data generally requires consent or a clear, specific legal basis this proposal shifts that. what “legitimate interest” means in practice: the company decides that its interest in using your data outweighs your interest in not having it used. The draft also proposes letting companies keep sensitive personal data that ends up in training sets “accidentally” if removing it would require “disproportionate effort.” with safeguards, but still. Who benefits: companies that already hold large amounts of European personal data which are mostly American and Chinese AI firms. Max Schrems’s framing: “digital expropriation.” Europeans’ data being taken and handed to companies without the people it belongs to having a say. where it stands: the EU Council approved their position. the European Parliament must still agree. this is not law yet but the Council’s backing is a significant step.