Most of us think it is important to choose which information we share with others, and what we keep to ourselves. Whether we are googling medical symptoms or finding out more about a political subject, our right to privacy gives us the freedom to learn about subjects we care about online, without our personal information, such as our political beliefs or medical history, being shared against our will.

Since AI LLMs entered the mainstream, many of us have started disclosing highly personal details to our chatbots. Whether we turn to our chatbot for health advice or guidance on how to navigate relationship issues, the personable nature of AI chatbots encourages us to reveal deeply intimate information.

But would we feel comfortable opening up if we knew our ChatGPT conversations could be used to train AI models, even when they contain our personal details?

What's happening now? EU Member States are finalising their position on the Digital Omnibus behind closed doors, one of a series of omnibus bills (giant laws that modify several laws at once) being pushed through under Von der Leyen’s deregulatory agenda.

The latest available Council text (Article 88a) included changes that would let AI companies use people's personal data to train their systems without requiring consent from people, weakening core GDPR and ePrivacy protections. Other potential amendments that Liberties finds highly concerning are the blurring of lines between anonymised personal information and pseudonymised personal information, making it more difficult to assess whether your personal data will be protected or not.

But if my data is pseudonymised, won’t my privacy be protected? Not necessarily. Pseudonymisation makes information safer by removing obvious identifying data, but because the personal profile remains intact, it is still possible to infer a person’s identity. Online tracking tends to work through pseudonymisation anyway. Information is only considered anonymised when it cannot be linked to a specific person.

What does it mean for ordinary people? Your ChatGPT conversations, or the posts you share on Facebook and Instagram, could be used to train AI models without the protections you have today. If a company says your information falls outside the GDPR because they believe your data is anonymised (when it is just pseudonymised), your information will not be protected.

So what, I have nothing to hide? Sure about that? Let me give you an example of how this could affect you. Say you’re applying for a job, and your prospective employer uses AI during its screening process (according to the World Economic Forum in 2025, 88% of companies do this). A recruiting tool called Eightfold AI already exists, which scrapes a job applicant’s social profiles, location data and online activity without their consent or even their knowledge (and has already scraped data from one billion workers, including in the EU). If these amendments are included in the Data Omnibus, companies like Eightfold will get even more access to your personal information based on your online activity. In layman’s terms, your prospective employer could access anything you posted on social media, and even your search history.

But will it make EU companies more competitive? The ‘competitiveness’ argument doesn't hold up. The Commission says this helps European AI firms catch up with the US and China. But the rules would apply to every company operating in Europe, so the biggest winners would be the very US and Chinese giants Europe says it's competing with.

An Irish Presidency, an Irish address for Big Tech: Ireland holds the Council Presidency and hosts the EU headquarters of most major tech companies. The Council is steering a deal that looks less like an industrial strategy and more like a gift to Big Tech.

Record speed, minimal scrutiny: Member States are moving far faster than the European Parliament, which is still working through detailed debates and disagreements on the same proposal.

We've seen this before: The rushed changes to the AI Act showed what happens when far-reaching rules are pushed through quickly. The damage to fundamental rights could be just as lasting here.

Why act now, not later: Once the Council locks in its position, it sets the starting point for negotiations with Parliament. Now is the moment when governments can still change course.

Civil society is raising the alarm: Liberties has written to EU Member States urging them to drop the AI-training provisions and protect the GDPR's core guarantees.