The EDPB web scraping guidelines finally set out how the GDPR applies to the data that trains generative AI — and they raise open questions that could determine whether AI models can still be built in Europe.