Consent stops meaning anything. The EU omnibus opens personal data to AI training

Thesis: if AI training becomes a default "legitimate interest", consent stops doing its protective job and the burden of proof shifts from the company to the citizen. This is not deregulation. It is a change to the system of data protection.

The debate over the EU data omnibus returned after the parliamentary summer break. It returned with the same idea the European Commission put into its original draft: personal data used to train AI systems would, in principle, count as a "legitimate interest". Companies would no longer need the user's explicit and informed consent, and they would not have to weigh interests in each individual case.

The immediate trigger is the Irish presidency's compromise of 3 September 2026, revealed by Politico. The proposal was already in the Commission's draft once, then disappeared during the Cypriot presidency, and now it is back. According to the German outlet "SZ Digitalwende", strong member states pushed for such a solution, Germany among them. Their argument: it would help European AI companies.

Max Schrems, chairman of the organisation noyb, answers without hedging: "The proposal clearly shows that the interests of AI corporations are to be placed above the constitutional right to data protection." He speaks plainly of the "digital expropriation of Europeans" and of "throwing European data completely open to global corporations". The removal of protection, he points out, will benefit above all those companies that have already collected the largest data sets. That argument is hard to rebut. The consent requirement was meant to even the odds between a giant and a small player. Abolished across the board, it is abolished mainly where the data already sits.

This is not an isolated case either. The same omnibus is to cover, among other things, the scrapping of cookie banners and the definition of personal data. Earlier, the same deregulation agenda cut environmental reporting duties and softened the rules on AI. The "simplification" argument sounds credible in the technical part: harmonising data breach reporting makes sense. Using it as cover for changing the training rules is a misuse of the label.

The second side of the same problem is the police. In Berlin, a new police law allows personal data to be processed again for training and testing AI systems. The answer to a Left party inquiry revealed that the data can be passed to private companies, such as Staige GmbH, linked to Adesso SE, which builds Berlin's behaviour scanners. Anonymisation is not required if it "stands in the way of testing or training purposes". The Left politician Niklas Schrader speaks of "a frighteningly good-natured opening of the door to the use of AI in policing". His party, together with the Greens, is taking the matter to the constitutional court.

This shows where the principle of default consent leads when it is applied instead of a balancing of interests. Citizens' data, including that of passers-by suspected of nothing, becomes fuel for developing technology, and control over it stops belonging to them. Instead of a default "allowed", Europe should require default transparency: a register of data sets, the purpose, the retention period and a real possibility to object. Otherwise the omnibus will not simplify the law. It will remove it where it is needed most.