EDPB Opinion 28/2024, para 92: a privacy notice is not enough to create expectations (EDPB Opinion 28/2024, adopted 17 December 2024, para 92)
Adding a line about AI to a privacy policy now does not settle what people reasonably expected when they gave their data. A holder should treat the notice as one factor, not as a cure.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Further, simply because information relating to the development phase of an AI model is included in the controller's privacy policy, it does not necessarily mean that the data subjects can reasonably expect it to happen; rather, this should be analysed by SAs on the specific circumstances of the case and considering all of the relevant factors.”
Where it was read
Also read from the same source
- EDPB Opinion 28/2024, para 66: the legitimate interest test must be assessed and documented (EDPB Opinion 28/2024, adopted 17 December 2024, para 66)
- EDPB Opinion 28/2024, para 101: masking and substituting personal data (EDPB Opinion 28/2024, adopted 17 December 2024, para 101(c))
- EDPB Opinion 28/2024, para 102: a waiting period and an unconditional opt-out (EDPB Opinion 28/2024, adopted 17 December 2024, para 102(a)-(b))
- EDPB Opinion 28/2024, para 114: corrective measures can reach the whole dataset (EDPB Opinion 28/2024, adopted 17 December 2024, para 114)
- EDPB Opinion 28/2024, para 129: the next party must check where the data came from (EDPB Opinion 28/2024, adopted 17 December 2024, para 129)
- EDPB Opinion 28/2024, para 134: a claim of anonymity must be shown (EDPB Opinion 28/2024, adopted 17 December 2024, para 134)
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide