A platform scrapes publicly posted EU user content from the open web to train machine-learning models without informing those individuals or establishing a clear lawful basis. Which statement is correct?

A platform that scrapes publicly posted EU user content from the open web to train machine-learning models without informing those individuals or establishing a clear lawful basis is wrong to assume publicity equals free-for-all: publicly available personal data remain personal data; scraping for ML still needs a lawful basis, purpose limitation, and transparency analysis. Visibility online does not delete GDPR. Claiming public web posts are outside GDPR because publication waives all rights forever fails. Saying ML training on public posts is always covered by scientific-research exemptions without notice fails—research provisions are conditional, not a silent vacuum right. Asserting only private messages—not public posts—can be personal data fails definitionally. Exam caveat: further processing of public-source data for ML is a new purpose requiring Art. 6 (and Art. 9 if special categories appear) plus fairness/transparency assessment; public availability is one factor, not a total exemption. Operational check: define lawful bases before scraping, filter special-category content, provide public notices where feasible, honour objections/opt-outs where applicable, minimise corpora, and document the balancing/accountability file.