Data rights and provenance

Tracking where training data came from, what licence it carries and whether its owners opted out, and the legal questions still open.

Layer 4 · Data · Build time · reviewed 2026-10-30

Read first: Pretraining data.

D1 · StoryFor young children and total beginners

Guess first: if a website says 'no robots', does the crawler have to listen?

Every piece of training data was made by someone. Some of it is free to use, some has rules, and some owners say no.

Provenance means keeping a record of where each piece came from, so people can check it was allowed.

Questions to ask about every piece of data

Where from?: who made it
What rules?: free, or with conditions
Did they say no?: like a 'no robots' sign
Write it down: so others can check

Like: Checking the label on every ingredient: where it came from and whether you may use it.

D2 · PictureFor curious beginners

Provenance is the record of a dataset's sources, licences and processing steps. Many public datasets are re-packaged from others, and licence details often get lost or mislabelled along the way.

Opt-outs let owners signal that they don't want their work used: a robots.txt rule aimed at a crawler, website terms, or machine-readable reservations. Honouring them is partly voluntary and partly a legal duty, depending on the country.

The law is still settling. Courts in several countries are weighing whether training on copyrighted work without permission is allowed, and some regions now require model makers to publish summaries of their training data.

The questions a piece of data should pass

Source: where did it come from?
Licence: what does it allow?
Opt-out: did the owner say no?
Personal data: remove or protect
Record: documented for audit

Like: Food labelling: every ingredient should be traceable back to the farm, with its allergens listed.
Where it breaks: Food can be recalled from shelves. Once data has shaped a model's weights there is no reliable way to take it back out, so an opt-out mostly affects future training runs.

D5 · FrontierFor experts

D2 says the law is still settling. The specific disputes are about training itself, how copies were obtained, and how opt-outs work at web scale.

Fair use, reasoned two ways. In June 2025 two US judges in the same district found training on books to be fair use. One called it exceedingly transformative but held pirated library copies were not (Bartz v. Anthropic); the other saw market dilution as the most plausible harm in a better-argued case (Kadrey v. Meta). Anthropic then settled the piracy claims for $1.5 billion, which the court finally approved in July 2026 (Jurist, 2026).

Opt-outs without a protocol. EU law lets rights holders reserve works from text and data mining by machine-readable means, but names no single format (Directive (EU) 2019/790).

Licence laundering. Popular dataset hosts omitted licences for over 70% of datasets and miscategorised them more than half the time (Longpre et al., 2023).

A shrinking commons. In one year about 28% of the most critical sources in a common web corpus became fully restricted, which favours organisations that already hold data or can pay (Longpre et al., 2024).

Examples as of 2026-10-30

Data Provenance Initiative
C2PA Content Credentials
Licensing deals between AI labs and publishers or platforms such as Reddit and News Corp
Lawsuits such as The New York Times v. OpenAI and Getty Images v. Stability AI

Sources

How it connects

Data rights and provenance licenses and documents Pretraining data.
Data rights and provenance supplies opt-outs to Data curation and mixing.