A user accepting an app’s general terms does not automatically answer every question about consent, lawful basis, content rights or use of the resulting model. Separate these decisions before collecting data.
Split the permission questions
Ask whether the person agreed to collect the material, whether training is within the stated purpose, whether the uploader controls third-party rights, and whether subsequent redistribution is allowed. Privacy permission and copyright permission are not interchangeable. Consent is not the only possible legal basis in all countries, and its validity is jurisdiction- and context-specific.
Keep evidence of choices
Record notice version, collection date, data class, purpose, relevant jurisdiction, consent status where relied on, withdrawal process and retention commitment. Avoid burying a significant training purpose inside vague interface copy. Where data is sensitive or comes from children, additional requirements may apply.
Understand revocation limitations
Deleting a stored training example, removing it from future runs and removing memorized influence from a deployed model are different operations. The UK ICO describes situations in which retraining or deletion of a model may be relevant to rectification and erasure requests. Promise only what the system can actually perform.
Evaluate legitimate interests separately
The European Data Protection Board’s Opinion 28/2024 discusses conditions and context for assessing legitimate interests and when an AI model may be anonymous. It does not authorize all AI model training or substitute for an individualized assessment. Keep copyright questions and employment or consumer power imbalances in view.
Review example
A photo service asks contributors to authorize image storage and, independently, possible model training. An image containing another person may raise separate likeness and privacy questions. The service records license and rights checks, explains withdrawal boundaries and does not claim a user’s single click covers unrelated third-party interests.
Sources & Further Reading
- EDPB Opinion 28/2024: Data protection aspects of AI models — European Data Protection Board.
- ICO: Ensuring individual rights in AI systems — UK Information Commissioner.
- Copyright and Artificial Intelligence report hub — U.S. Copyright Office.
Evidence checked 25 October 2026. Applicability: EU/UK legal context; other regions separate. This material is general education, not legal, medical, investment or other professional advice. No vendor performance test is implied.