PARIS, 28 Oct. - (ANA) - AI models rely on ever larger volumes of high-quality data, which may include personal data. 

 

Yet privacy-compliant data collection can strengthen data quality by fostering user trust. 

 

From opt-out mechanisms to machine unlearning, solutions are emerging to enhance user control over data collected through chatbots and other generative AI systems, or through web scraping.

 

But removing personal data memorised by AI models remains hard, and regulators and industry will need to work together pragmatically. 

 

 

 

 

Building AI models requires vast amounts of high-quality data, some of which inevitably includes personal data. Yet privacy-compliant data collection can strengthen data quality by fostering user trust. 

 

This policy brief examines how user control and privacy protections can be enhanced across two prominent data collection mechanisms: user interactions with generative AI systems such as chatbots, and web scraping of publicly available data. 

 

It reviews emerging regulatory guidance and industry practices, including transparency and opt-out tools, privacy-enhancing technologies, user rights and redress mechanisms, and multi-stage data filtering. 

 

It also explores the challenges of data memorisation in model weights, the promise of machine unlearning, and the implications of agentic AI systems. 

 

The brief concludes with recommendations for policymakers to support pragmatic collaboration between regulators and industry, while safeguarding user control over personal data. 

 

 

 

 

• Building AI machine-learning models often requires large volumes of high-quality data, which

may (purposefully or inadvertently) include personal data. This creates a dual need: to continue

facilitating access to high-quality data across the AI lifecycle, while ensuring privacy and users’ control over their personal data. Both objectives are complementary since privacy-compliant data collection contributes to data quality by fostering trust and more willingness to share data. These objectives also need to be pursued alongside appropriate safeguards for other legitimate rights and interests involved in the collection, access and use of data, including intellectual property rights (IPRs) and other proprietary rights.

 

• A significant share of AI training data originates from user interactions with generative AI

systems, particularly in business-to-consumer (B2C) settings such as AI chatbots, as well as

from the scraping of data that is publicly available on the internet. In addition to static training datasets, AI systems are increasingly integrating dynamic approaches such as Retrieval-Augmented Generation (RAG) to access and incorporate external information in real time.

 

• Recent regulatory guidance from Privacy Enforcement Authorities (PEAs) emphasises that AI

chatbots should inform users about how personal data from prompts are processed, and

whether they will be used for training or refining models. Many developers are improving

transparency and offering global opt‑out mechanisms, but there is scope to design more

granular user controls, supported by “just-in-time transparency” mechanisms that deliver

relevant information at the moment of interaction rather than relying solely on privacy policies.

 

• Personal data can become embedded in AI model weights or “memorised” during training,

creating challenges for access, correction, and erasure. Fully removing data from such models

would require significant technical effort, calling for pragmatic collaboration between industry

and regulators to protect user interests while taking technical realities into account.

 

• As AI systems evolve towards more autonomous agentic forms, the focus will shift from direct

user interactions to agentic/multi-agent systems that can take complex actions autonomously.

This will challenge the application of traditional data protection principles, but AI agents could also support users in managing privacy across complex data interactions.

 

• The governance of web-scraped data for AI training is evolving through a combination of

regulatory guidance, industry standards and technical safeguards.   - (ANA) -

 

For the full report, visit: https://www.oecd.org/content/dam/oecd/en/publications/reports/2026/10/enhancing-user-control-and-privacy-protections-in-the-context-of-ai_a177834f/e0bd9a46-en.pdf

 

 

AB/ANA/28 October 2026 - - -