A dataset download is not a license. Teams need evidence for every material source, transformation and downstream use.
Start with provenance, not file names
A public dataset may combine independently licensed works, scraped web pages, user submissions and metadata. Its landing-page license may not cover all embedded images, audio or personal information. Record where each component originated, the publisher, source URL, date obtained and terms governing the particular asset. Separate copyright permission from privacy, contract and personality rights; satisfying one does not resolve the others.
Read the actual permission
Check whether the license permits copying, modification, redistributing, commercial use and training or model-building activities, and whether the chosen jurisdiction changes the legal analysis. Attribution and share-alike obligations can depend on what is distributed and how the work is used. Do not infer that an open model, open repository or academically published dataset automatically grants unrestricted commercial rights. Save a dated copy of the terms and identify any exclusions.
Track derivatives and mixtures
If images are resized, captions synthesized or corpora deduplicated, retain a record connecting the output to underlying sources where feasible. Model training creates practical lineage challenges; a transformation may not eliminate upstream restrictions. A dataset card can describe origin and known limitations, but it is not a substitute for evidence that the contributor had the necessary rights.
Rights clearance for sensitive content
Consent for creating a photograph may not cover using a person’s likeness in a commercial model. A voice recording may involve performer, recording and publicity interests. Privacy law can apply to identifiable people independently of copyright. For high-risk material, seek appropriate specialist legal advice and document the permitted purpose and duration instead of reusing a generic consent checkbox.
When records are missing
Unknown permission should be an explicit blocker or legal review item, not marked as ‘public domain’ because it was found on the open web. Where possible, substitute an asset with clear contractual rights or independently create source data. Do not use generative AI to fabricate provenance evidence after the fact.
Example: an image-caption corpus
A research team wishes to commercialize a captioning model trained on images assembled from several websites. The team needs an inventory of asset origins, rights and applicable terms as of collection, plus evidence for captions and any person-related data. If one subset cannot be cleared, segregate it and evaluate retraining or replacement. A general claim of educational intent is not a universal defense.
Legal limits of this article
The U.S. Copyright Office AI inquiry distinguishes issues about AI-generated outputs and the use of copyrighted material in training. Litigation and laws vary by jurisdiction and date; this guide makes no blanket claim that a particular training use is fair use or infringement. Maintain counsel-reviewed status and update it as cases and statutes develop.
Sources & Further Reading
- U.S. Copyright Office AI reports — U.S. Copyright Office.
- Opinion 28/2024 on data protection aspects of AI models — EDPB.
- NIST AI Risk Management Framework 1.0 — NIST.
Primary Scope and applicability vary by task and jurisdiction. This article is educational guidance, not legal, medical or financial advice.