The EU's data protection agency, EDPB, has clarified conditions under which AI models can access personal data, establishing a three-stage test for 'legitimate interest.' This follows a request from Ireland's DPA regarding compliance with EU law. The opinion emphasizes the need for anonymity in AI models and the importance of transparency in data processing. While the ruling was welcomed by tech industry representatives, digital rights advocates expressed concerns about the feasibility of ensuring anonymity and the potential for inconsistent enforcement by national authorities. Further guidelines on web scraping are anticipated.