Training a model on data about people is processing personal data. In Europe that needs a lawful basis. Consent is rarely practical at scale, so most developers rely on legitimate interests.
European Union
In December 2024 the European Data Protection Board set out its view in Opinion 28/2024. Legitimate interests can be a valid basis for developing and deploying AI, but only if the three-step test is passed: a legitimate interest, processing that is necessary for it, and a balance that does not override individuals’ rights. Reasonable expectations matter, including where the data came from and whether it was public. The Board also said that a model trained on unlawfully processed data may affect the lawfulness of its later use, unless the model has been properly anonymised, and that whether a model is anonymous is a case-by-case question.
The Commission’s Digital Omnibus would add an express provision on processing for AI development. That proposal is not yet law.
United Kingdom
The UK GDPR applies the same structure. AI training is not on the new list of “recognised legitimate interests” that skip the balancing test, so the full test still applies. Special category data, such as health data, needs an additional condition.
United States
There is no general requirement of a lawful basis. State privacy laws require notice and opt-outs, consent for sensitive data in some states, and Connecticut now requires privacy notices to say whether data is used to train large language models. The Federal Trade Commission has in past cases required companies to delete models built on improperly obtained data.
In Europe the risk is not only a fine. It is being told the model itself cannot be used.
What to do
Document a legitimate interests assessment before training, record where the data came from, and test whether personal data can be extracted from the model.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.