Training-Data Rights

Definition and scope

Copyright, consent, text-and-data-mining exceptions.

The cross-jurisdiction picture below shows how each of 29 tracked instruments treats this topic. The patterns vary substantially — and 19 regimes are silent, leaving gaps that future policy work could address.

Historical primacy & cross-jurisdiction tension

First addressed by NIST AI Risk Management Framework on 2023-01-26 (implicit). Subsequent regimes have either codified, diverged from, or remained silent on this baseline.

• Forum-shoppingInterim Measures for Generative AI Service Management↔Executive Order 14110 on Safe, Secure, Trustworthy AI
• Forum-shoppingNIST AI RMF Generative AI Profile↔Executive Order 14179 — Removing Barriers to American Leadership in AI
• Forum-shoppingIndia Digital Personal Data Protection Act + AI Advisory (MEITY)↔UK Pro-Innovation Approach to AI Regulation (White Paper)

Cross-jurisdiction coverage

Silent regimes — gap signal

Instruments that do not address Training-Data Rights — candidates for future policy work.

• Executive Order 14110 on Safe, Secure, Trustworthy AIUS
• Executive Order 14179 — Removing Barriers to American Leadership in AIUS
• UK Pro-Innovation Approach to AI Regulation (White Paper)UK
• G7 Hiroshima AI Process Code of ConductG7
• OECD AI Principles (Recommendation)OECD
• UN GA Resolution on Safe, Secure, Trustworthy AIUN
• Bletchley Declaration on AI Safetyglobal
• Seoul Declaration on Safe, Innovative and Inclusive AIglobal
• California SB-1047: Safe and Secure Innovation for Frontier AI Models ActUS
• ASEAN Guide on AI Governance and EthicsASEAN
• Anthropic Responsible Scaling Policy (RSP) v2US
• OpenAI Preparedness FrameworkUS
• Google DeepMind Frontier Safety FrameworkUS
• UK-US AI Safety Institute Memorandum of Understandingglobal
• White House Voluntary AI CommitmentsUS
• Singapore Model AI Governance Framework for Generative AISG
• NYC Local Law 144 of 2021 (Automated Employment Decision Tools)US
• Colorado Artificial Intelligence Act (SB 24-205)US
• Illinois HB 3773 / Public Act 103-0804 (AI Employment Discrimination)US

Related enforcement cases

Documented enforcement actions where regulators invoked a rule against a deploying organisation, with the primary-source case record and the lesson the field has drawn from each.

• FTC investigation of OpenAIUS · 2023 · ongoing
  Federal Trade Commission v. OpenAI — Civil Investigative Demand alleging consumer-protection violations: misleading claims about ChatGPT capabilities, training-data privacy, and consumer harm from hallucinations.
  Lesson: First US federal enforcement action against a frontier-AI developer. Establishes that pre-AI-statute consumer-protection authority (FTC §5) can be applied to AI services — supports the US 'sectoral / ex-post liability' regime (vs EU's ex-ante AIA). Action remains pending; no judgment yet.
  Source record →news secondary
• New York Times v. OpenAI + MicrosoftUS · 2023 · ongoing
  New York Times Company (private civil litigation) v. OpenAI Inc. + Microsoft Corp. — Unauthorised reproduction of NYT-copyrighted articles in GPT training corpora; output of substantially similar text on prompted query; removal of copyright-management information.
  Lesson: First major frontier-foundation-model copyright lawsuit by a primary news source. Discovery has surfaced disclosure of training-data composition that the EU AIA Art. 53 transparency requirements would have surfaced ex-ante. The case is the highest-stakes ex-post-liability action testing whether US sectoral approach can substitute for ex-ante regulation on training-data rights — outcome will inform 2025-2027 regulatory debates.
  Source record →
• EDPB ChatGPT TaskforceEU · 2023–2024
  European Data Protection Board (EDPB) — coordinated DPA action v. OpenAI — Italian Garante temporarily banned ChatGPT (Mar-Apr 2023) over alleged lack of legal basis for training-data processing, missing age-verification, and inability to honour data-subject rights. EDPB convened taskforce to coordinate DPA responses.
  Lesson: First EU-wide AI enforcement coordination predating the EU AIA. Established that GDPR applies fully to LLM training + deployment + that DPAs would coordinate via EDPB rather than fragment. ChatGPT resumed Italian service after age-verification + Article-15 right-of-access endpoint additions. Direct precedent for EU AIA Art. 53 implementation timeline.
  Source record →
• Italian DPA — Clearview AIEU · 2021–2022
  Garante per la protezione dei dati personali (Italian DPA) v. Clearview AI Inc. — Mass scraping of publicly-available facial images + biometric processing without legal basis under GDPR. Provision of services to Italian users without GDPR-compliant data-processing arrangements.
  Lesson: €20M fine + mandatory deletion of Italian-resident facial-recognition data. Established that GDPR provides binding enforcement authority for biometric-AI applications even where no AI-specific instrument exists. Replicated in France (2022) + UK (2022) + Greece (2022) — the only successful cross-jurisdictional AI enforcement so far.
  Source record →
• France CNIL — Clearview AIEU · 2020–2023
  Commission nationale de l'informatique et des libertés (CNIL) v. Clearview AI Inc. — Mass scraping of facial images of French residents + biometric processing without lawful basis. CNIL imposed €20M fine + 5x €100k/day penalty for non-compliance with deletion order.
  Lesson: Parallel to Italian Garante action; both fined identical €20M amount within 6 months. CNIL added 5x €100k/day non-compliance penalty when Clearview refused deletion — escalation pattern that EU AIA Art. 99 (penalties up to 7% global turnover) extends. Multi-DPA replication confirms GDPR is enforceable against US-based AI providers serving EU residents.
  Source record →

Related topics

Topics with similar coverage patterns across the tracked instruments.

• Individual Redress
• Agentic AI Governance