Building AI models requires vast amounts of high-quality data, some of which inevitably includes personal data. Yet privacy-compliant data collection can strengthen data quality by fostering user trust. This policy brief examines how user control and privacy protections can be enhanced across two prominent data collection mechanisms: user interactions with generative AI systems such as chatbots, and web scraping of publicly available data. It reviews emerging regulatory guidance and industry practices, including transparency and opt-out tools, privacy-enhancing technologies, user rights and redress mechanisms, and multi-stage data filtering. It also explores the challenges of data memorisation in model weights, the promise of machine unlearning, and the implications of agentic AI systems. The brief concludes with recommendations for policymakers to support pragmatic collaboration between regulators and industry, while safeguarding user control over personal data.
