<\/p>\n
As countries grapple with the legal and ethical implications of training AI models on publicly accessible personal information, divergent regulatory approaches threaten to reshape global AI leadership and privacy protections.<\/p>\n<\/div>\n
Should AI models be permitted to train on personal information that is publicly available on the Internet? The question is no longer theoretical; how countries answer it will shape which jurisdictions foster large-scale AI development and which prioritise stricter privacy protections. According to the Data Innovation report, developers today build generative models from a mix of publicly available web content, licensed archives, user-submitted inputs, proprietary corpora and synthetic data, and much of that publicly accessible material contains personally identifiable information. [1]<\/a><\/sup><\/p>\n For decades search engines have operated on the premise that content posted to the open web can be crawled, indexed and repurposed with limited privacy friction. That default is under pressure in Europe. The European Union\u2019s General Data Protection Regulation requires a lawful basis for processing personal data even if it is publicly accessible,and the GDPR\u2019s right to be forgotten has already forced search engines to delist links to lawful material to protect privacy,illustrating that public availability does not automatically confer unfettered reuse. Regulators must now decide whether training AI on scraped web data meets the GDPR\u2019s \u201clegitimate interest\u201d test,an assessment that invites discretion and legal uncertainty. [1]<\/a><\/sup><\/p>\n By contrast,the United States maintains a materially different posture:companies generally face few legal restraints on crawling publicly accessible websites,and state privacy regimes such as California\u2019s focus more on data businesses collect directly from consumers than on open-web scraping. That divergence between EU and US frameworks has tangible consequences for where companies choose to train models at scale and how quickly they can iterate. [1]<\/a><\/sup><\/p>\n Practical and contractual mechanisms have emerged to mediate these tensions. The robots.txt protocol and newer standards under development at the Internet Engineering Task Force allow site owners to signal whether automated systems may access their content; some publishers have adopted \u201cpay-to-crawl\u201d models to monetise access;and AI firms themselves often avoid scraping websites dominated by personal data. These tools give content owners leverage,even if they were not designed specifically to regulate personal information in model training. [1]<\/a><\/sup><\/p>\n Regulators beyond Europe and the US are also asserting limits. In June 2024 Brazil\u2019s national data protection authority ordered Meta to stop using platform data to train AI models,citing risks to individuals\u2019 fundamental rights and criticising opaque opt-out mechanisms,a decision the company called a setback for innovation. The move signalled that privacy-first enforcement is not confined to Europe and that multinational platforms face a patchwork of national requirements. [6]<\/a><\/sup><\/p>\n At the same time, US and state-level enforcement is tightening expectations for AI accountability. In April 2024 Massachusetts Attorney General Andrea Campbell issued an advisory reminding developers that consumer-protection,anti-discrimination and data-security laws apply to AI systems and that claims of a model being a \u201cblack box\u201d do not excuse biased or unlawful outcomes. The advisory underscores that legal scrutiny will target how systems are built and deployed,not only what data was collected. [2]<\/a><\/sup><\/p>\n Legislative efforts are also shaping the transparency landscape. According to the bill text, the Generative AI Copyright Disclosure Act,introduced to Congress in April 2024, would require companies to disclose copyrighted works used in training to the Register of Copyrights ahead of a model\u2019s release and impose penalties for non-compliance,a requirement aimed at protecting creators and increasing visibility into training data provenance. Such proposals,if enacted,would add compliance costs and procedural steps for model publishers. [3]<\/a><\/sup><\/p>\n Commercial decisions reflect this regulatory mix. Some firms have modified data policies and introduced explicit opt-ins or opt-outs for user-provided content;Anthropic\u2019s 2025 update required users to choose whether their chats could be used for future training,with prolonged retention for opted-in data, a move the firm said would improve capabilities while critics warned of privacy risks. Meta in 2025 likewise announced a resumption of EU training on publicly posted content after engaging EU regulators and committing to user notifications and objection mechanisms. These developments show companies pursuing different compliance strategies while insisting on the necessity of broad datasets for model quality. [5]<\/a><\/sup>[4]<\/a><\/sup><\/p>\n ##Reference Map:<\/p>\n\ud83d\udccc Reference Map:<\/h3>\n
\n