Prompt20
NewsDataBlog
All posts
copyrighttraining-datafair-useintellectual-propertylicensinglawsocietyevergreen

AI Copyright and Training Data: Who Owns What the Machine Learned

Two questions people conflate: is training on copyrighted data legal, and can AI output itself be copyrighted. Fair use, opt-outs, licensing deals, and what creators and builders can actually do.

By Prompt20 Editorial · 26 min read

Almost every argument about "AI and copyright" is really two arguments wearing one coat, and they point in opposite directions. The first is about the input: was it legal to train a model on copyrighted books, images, and code the developer never licensed? The second is about the output: once the model generates something, who — if anyone — owns it? Confuse the two and you'll reach nonsense conclusions, like assuming that if training is fair use then the output must be free for all, or that if you can't copyright AI art then training must have been theft. Neither follows.

Here's the short version, and the rest of this piece is why. Training on copyrighted data is a fair-use question that generally turns on how "transformative" the use is and whether the output competes with the original — courts have been sympathetic to training itself but hostile to models that regurgitate or substitute for the source. And purely AI-generated output is, in most jurisdictions, not copyrightable at all, because copyright protects human authorship. Two questions, two different bodies of law, two different sets of practical steps. Let's keep them apart.

Key takeaways

  • Input and output are separate legal questions. "Is training legal?" is about copying someone else's work to build a model. "Can I own the output?" is about whether a machine's product qualifies for protection. Answers to one don't determine the other.
  • Training is usually analyzed as fair use (in the US) or under text-and-data-mining exceptions (in the EU and elsewhere). The durable factors: how transformative the use is, and whether the model's output substitutes for the original in its market.
  • Memorization is the legal fault line. A model that learns statistical patterns is a much stronger fair-use story than one that reproduces training examples near-verbatim. Regurgitation is where "learning" becomes "copying."
  • Human authorship is the bar for owning output. Fully machine-generated work generally can't be copyrighted. Human creative contribution — meaningful selection, arrangement, editing — is what pulls a work back into protectable territory.
  • Licensing is eating the gray area. Rather than litigate fair use forever, large developers increasingly buy data. That trend tells you where the risk actually sits.
  • Practical hygiene beats prediction. You can't forecast the case law, but you can log provenance, respect opt-outs, add a human editing layer, and read your vendor's indemnity clause.

Table of contents

Question one: is training on copyrighted data legal?

Training a modern model means copying a lot of things. To learn from a book, the pipeline has to ingest the book — download it, tokenize it, run it through the model thousands of times. Each of those steps is, technically, reproduction, which is exactly the right copyright holders control. So the raw act of training touches copyright. The question is whether it's excused.

In the US, the escape hatch is fair use — a four-factor balancing test that courts apply case by case. The two factors that matter most for AI are the purpose of the use (is it "transformative" — does it serve a different function than the original?) and the effect on the market (does it undercut the original's commercial value?). The middle factors — the nature of the work and how much was copied — matter, but they rarely decide these cases.

The transformative argument for training is genuinely strong. A model doesn't store a copy of your novel; it adjusts billions of numerical weights so that, in aggregate, it gets better at predicting text. The purpose — building a general-capability system — is different from the purpose of the novel, which is to be read. Courts have historically treated large-scale copying as fair use when the output is a new function rather than a substitute: think search-engine indexing, or scanning books to make them searchable. Training rhymes with those.

But the market-harm factor is where it gets uncomfortable, and where the two questions start to touch. If a model can reproduce large chunks of a specific work on demand, or generate outputs that directly compete with and displace the originals — a model that spits out functional replacements for a stock-image library, say — then "transformative" starts to look like a fig leaf. The strongest legal position for a developer is: the model learned patterns, it does not emit copies, and its outputs don't substitute for any particular input. The weakest is a model that memorized its training set and happily coughs it back up.

Outside the US, the framing differs but the intuition rhymes. The EU built explicit text-and-data-mining (TDM) exceptions: mining is permitted, but rightsholders can opt out in a machine-readable way (and if they do, you need a license). Other jurisdictions land in between. The practical upshot is the same everywhere — respecting expressed opt-outs is both legally safer and cheaper than arguing about it later. If you want the mechanics of how models actually turn text into those weights (and why "the model contains a copy" is a misconception), see how AI chatbots work.

One more distinction is worth planting early, because it dissolves a lot of confused debate. There are actually at least three copies happening in a training pipeline, and they are not equally defensible. First, the acquisition copy: downloading, scraping, and storing the source material — this is a reproduction whether or not you ever train on it, and where the material was pirated (say, obtained from a shadow library), the provenance of that copy is a liability entirely separate from the training question. Second, the intermediate copies made during preprocessing and the training run itself — tokenized shards, cached batches, checkpoints. Third, the model weights, which the developer will argue are not a copy of anything in the copyright sense but an abstraction learned from the corpus. A plaintiff who cannot win on the weights may still win on the acquisition copy. This is why "did you have lawful access to the data in the first place" is frequently the sharpest question in a training dispute — it sidesteps the hard, unsettled fair-use analysis and lands on something courts already understand: you can't launder an unlawfully obtained copy by feeding it to a neural network.

The four fair-use factors, applied to training

Because so much of the US analysis rides on fair use, it's worth walking through the actual statutory factors rather than gesturing at "transformativeness." US fair use weighs four factors, and none is dispositive on its own — a court balances them together. Applied to model training, they break down like this.

Factor one — the purpose and character of the use. This is the transformativeness factor, and it's where developers are strongest. The question courts ask is whether the new use adds something with a further purpose or different character, or merely supersedes the original. Training a general-purpose model to predict tokens is a genuinely different function from the expressive purpose of any individual work in the corpus. The classic analogies are search indexing and mass digitization for full-text search, both of which courts treated as transformative because they turned expressive works into a tool for finding or analyzing rather than a substitute for reading. But this factor also weighs commerciality, and frontier training is intensely commercial — which tempers, without erasing, the transformative point. And a subtle wrinkle from recent doctrine: transformativeness is evaluated against the specific use, so a court may distinguish between training a model and the model's downstream commercial deployment.

Factor two — the nature of the copyrighted work. This factor mildly favors plaintiffs when the works are highly creative (novels, art, music) rather than factual, and when they were unpublished. In practice it rarely decides AI cases, because training corpora are enormous mixtures of everything. It's a thumb on the scale, not the fulcrum.

Factor three — the amount and substantiality used. Training typically ingests entire works, and copying the whole thing normally cuts against fair use. But courts have repeatedly held that copying 100% of a work can still be fair when the quantity is reasonable relative to the transformative purpose — you can't build a full-text search index or a language model from fragments. So this factor is less damaging to developers than it first appears, provided the copied whole is genuinely necessary to the transformative function and not exposed to the user.

Factor four — the effect on the market for the original. Long treated as the most important factor, this is the developers' point of maximum exposure. It asks not just whether the specific copying harmed sales, but whether the challenged use, if it became widespread, would harm the market for the original or for its derivatives and licensing. Two market-harm theories collide here. The narrow theory: does the model output substitute for the specific work (does it reproduce the novel, replace the stock photo)? The broad theory, which rightsholders increasingly press: even if no output is a copy, the training itself deprived them of a licensing market — the money they could have charged to license the data for training. That second theory is circular and contested (it assumes a market exists precisely because someone wants to be paid), but it is the argument most likely to move the market-harm factor against developers, and it is one reason licensing deals keep appearing.

The honest summary: factors one and three tend to favor developers, factor two is a wash, and factor four is the battlefield. When commentators say "training is probably fair use but it depends," they mean it depends on factor four, and factor four depends heavily on how much the model memorizes and regurgitates — which is the next section.

Memorization: where "learning" becomes "copying"

The single most important technical fact for the input question is memorization. Large models do sometimes store and regurgitate specific training examples — especially content that appeared many times in the data, or unusually distinctive strings. From a copyright standpoint, a model that reproduces a passage verbatim is doing something categorically different from a model that has merely absorbed the statistics of English prose.

This is why "we only trained on it, we didn't copy it" is a claim about behavior, not just intent. If your model can be prompted to emit training data, the fair-use story weakens no matter how noble the training goal. It's also why serious developers invest in deduplication, memorization testing, and output filters — not only for quality but as legal risk management. Retrieval systems raise a related wrinkle: a model that fetches and quotes source text at inference time (see RAG in production) is reproducing content in a much more direct way than one relying on trained weights, and it should be reasoned about as copying at query time, not learning at training time.

It helps to understand why memorization happens, because the mechanism explains the legal risk profile. A model is trained to minimize prediction error over its corpus. For content that appears once and looks like everything else, the cheapest way to reduce error is to learn general patterns. But for content that appears many times (duplicated across the web), or is highly distinctive (a specific poem, a famous opening line, a block of licensed code), the model can reduce error further by effectively storing the sequence. Memorization is therefore not a bug bolted on top of learning — it is the same optimization pressure, applied to data where rote recall happens to be the lowest-loss strategy. Two levers dominate it: duplication in the training set, and model capacity relative to data (larger models with more parameters memorize more readily). This is why deduplication is the single most effective mitigation: strip the near-duplicates and you remove the gradient pressure that carves a verbatim copy into the weights.

That mechanism also draws a useful line between two things that get conflated. Extractable memorization is when an adversary can craft a prompt that pulls training data back out — this is the acute copyright risk, because it produces an actual copy in the user's hands. Eidetic-style latent memorization is when the data is encoded in the weights but no known prompt reliably surfaces it — legally murkier, because there may be no reproduction to point at. The defensive engineering stack maps onto this: deduplication reduces how much gets memorized; memorization audits (probing the model with training-set prefixes to see if it completes them verbatim) measure what leaked in; and output-side filters (blocking generations that match known copyrighted strings) catch reproduction at the door even when the weights still hold the memory. None of these is perfect, and a plaintiff's expert who can demonstrate extraction in the courtroom has a vivid, jury-legible story that no amount of "it only learns statistics" rebuts.

There is a mirror-image risk for images and code that deserves its own note. In diffusion models, memorization tends to surface as near-duplicate reconstructions of training images that were heavily duplicated (product photos, iconic artworks). In code models, it can surface as verbatim emission of licensed source — which raises not only copyright but license-compliance problems, because open-source licenses like the GPL attach obligations (attribution, copyleft) that a stripped, unattributed regurgitation violates even when the code was "free." A model that reproduces a distinctive licensed function without its license header has arguably created an infringing, non-compliant copy, and the fact that the original was public does not cure it.

Fair use vs text-and-data-mining: how jurisdictions differ

"Is training legal?" has no single global answer, and the differences aren't cosmetic — they flow from two fundamentally different legal architectures. The US uses an open, standard-based system (fair use): a flexible four-factor test that a court applies after the fact, which means broad potential coverage but genuine unpredictability. Europe and much of the rest of the world use a closed, rule-based system: copying is infringement unless it fits a specifically enumerated exception. Under the closed model you don't get to argue "but it was transformative and fair" — either your use lands inside a written exception or it doesn't. That structural split explains why the same activity can feel presumptively permissible in one country and presumptively infringing in another.

Here is the landscape as of writing, framed at the level of durable structure rather than any single pending case:

Jurisdiction Governing framework Opt-out? Practical posture
United States Fair use (four-factor balancing) No formal opt-out; robots directives are contractual/norm-based, not statutory Broadly permissive in principle, but case-by-case and unpredictable; market-harm factor is the battleground
European Union TDM exceptions (a mandatory one for research; a broader one for everything else) Yes — commercial TDM allowed unless the rightsholder reserves rights in a machine-readable way Structured and predictable; respecting machine-readable opt-outs is close to mandatory for commercial training
United Kingdom Narrow TDM exception (non-commercial research only, as of writing) N/A for commercial use Restrictive for commercial training; policy under active debate about whether to broaden
Japan Explicit statutory exception permitting use for "information analysis," widely read as training-friendly Limited carve-outs where use unreasonably harms rightsholders Among the most permissive regimes for training
Others (Singapore, Israel, etc.) Varying mixes of computational-analysis exceptions or fair-use-style tests Varies Several deliberately positioned as training-friendly to attract AI development

A few implications matter more than the table itself.

The opt-out is the pivotal design choice. The EU's approach effectively says: train freely, but honor a rightsholder's machine-readable "no." This converts an intractable fair-use fight into an engineering-and-compliance problem — did you check for and respect the reservation signal? It also creates a concrete obligation that scrapers can technically satisfy or provably violate, which is why opt-out signalling (and the standards for expressing it) is becoming load-bearing infrastructure rather than a footnote.

Jurisdiction shopping is real but limited. A developer can train in a permissive jurisdiction, but copyright is territorial: if you deploy the model to users in a stricter jurisdiction, the reproduction and distribution happening there can still be reached by that jurisdiction's law. Where you ran the GPUs is not a full shield for where you sell the output. This is one reason the largest developers gravitate toward licensing regardless of where they train — a license travels across borders in a way a favorable local exception does not.

"It was public on the internet" is not a legal category anywhere. Publicly accessible is not the same as public domain, and it is not the same as licensed for training. In every framework above, the copyright in a freely readable blog post, photo, or repository remains with its author. Accessibility governs whether you can copy it technically; it says nothing about whether you may.

The durable lesson for a builder is to stop asking "is training legal?" as if it had a yes/no answer, and start asking "under which framework, for which market, with what opt-out obligations, and with what provenance for the underlying copies?" Those four sub-questions are answerable today; the headline question is not.

Question two: can AI output be copyrighted?

Now flip to the other side of the coin, and notice the answer is almost independent of the first. Even in a world where all training were unambiguously legal, you still face the question: can you own what the model produces?

The durable principle across most of the world is that copyright protects human authorship. A work created entirely by a machine, with no meaningful human creative input, generally falls outside copyright — it lands in a kind of public-domain-by-default. Registration offices have repeatedly declined to register works listing an AI as the author, and the reasoning is consistent: copyright is an incentive for human creativity, and there's no human to incentivize.

That sounds harsh for anyone building on generative tools, but the doctrine leaves a wide, usable door open: human contribution. Copyright has never required that you personally execute every mark. It requires human creative choices. A photographer doesn't paint the light; they choose the framing, moment, and settings. Applied to AI, the question becomes: did a human make enough creative decisions that the final work reflects human authorship?

That's a spectrum, not a switch:

Scenario Human creative input Likely protectable?
One-line prompt, raw model output, used as-is Minimal (idea only) Generally no
Extensive prompting, curation, and selection among many outputs Moderate The arrangement/selection may be; the raw output usually isn't
AI output as raw material, heavily edited, composited, and reworked by a person Substantial Yes, for the human-authored contribution
AI used as one tool inside a larger human-authored work Substantial Yes, for the overall work

The important nuance: even when the whole isn't protectable, the human-authored parts — your specific edits, your arrangement of many pieces, the surrounding creative work — can be. Prompts themselves are usually treated as unprotectable ideas or instructions, not authorship, which is one reason "prompt engineering" doesn't buy you ownership of the output on its own. If you're trying to get more control and consistency out of models, that's a craft question worth reading up on (writing better prompts) — just don't mistake craft for a property right.

Two deeper points make the "human authorship" bar less mysterious. The first is why copyright insists on it. The doctrine is not squeamishness about machines; it's the internal logic of the system. Copyright is a bargain: society grants a time-limited monopoly to incentivize human creation. A machine needs no incentive, faces no opportunity cost, and will produce output whether or not it is rewarded — so extending it a monopoly buys society nothing and costs it a locked-up public domain. The human-authorship requirement is the load-bearing wall of that bargain, which is why registration offices and courts return to it so consistently rather than treating it as a technicality that a clever filing could route around.

The second point is that "human authorship" is not measured by effort, and not by control at the sausage-machine level, but by whether a human made the expressive choices that the final work embodies. This is subtle. Spending eight hours re-rolling generations is effort, but if the machine determined the expressive details of whichever output you eventually kept, the choices in that specific image were still the model's; your contribution was selection among outputs, which protects the selection, not the underlying image. By contrast, using generative output as one layer in a composited, edited, human-directed work injects expressive human choices into the fabric of the result. The line the offices are drawing is between conceiving/selecting (weakly protective, if at all) and executing expressive choices that are visible in the work (protective). Traditional tools sit on the strong side of that line — a camera or a synthesizer executes the artist's specific choices — which is exactly why "AI is just a tool like Photoshop" is an argument about degree of human expressive control, not a magic phrase that confers authorship.

There is also a jurisdictional wrinkle here that mirrors the training map. A handful of jurisdictions have statutory provisions for "computer-generated works," assigning authorship to the person who made the arrangements necessary for the work's creation, and granting a shorter term. These are the exception, not the rule, and their scope is contested — but they mean the flat statement "AI output can never be copyrighted" is too strong globally. The durable, defensible version is: in most major jurisdictions, output with no meaningful human expressive contribution is unprotectable, and where special provisions exist they are narrow and grant thinner rights.

Output infringement: the third question hiding inside the second

There's a question that is neither "was training legal?" nor "can I own the output?" and it trips up almost everyone: can the output itself infringe someone else's copyright? The answer is yes, and it is independent of both other questions. This is the third rail, and it matters enormously in practice because it is the risk that lands on the user, not the developer.

Work through the logic. A model's output can be uncopyrightable (because you didn't author it) and infringing (because it reproduces protected expression from a third party) at the same time — those are not contradictory; they are answers to different questions. If you prompt a model and it returns something substantially similar to a specific copyrighted character, photograph, song, or block of code, then publishing or commercializing that output can be infringement, regardless of whether the training was fair use and regardless of whether you can claim any ownership. The model is, in that moment, functioning as a very sophisticated copying machine, and the person who takes the copy and uses it commercially is the one exposed.

Two doctrines govern this. The first is substantial similarity: infringement of expressive works turns on whether the output copies protected expression (not mere ideas, style, or facts) closely enough. Style is famously hard to copyright — you can imitate an artist's aesthetic without copying any specific work — but a generation that reproduces the actual composition, characters, or passages of an identifiable work crosses from homage into copying. The second is independent creation as a defense that may not apply: normally, if you created something without copying, you're safe even if it resembles another work. But when a model has demonstrably ingested the original and then reproduces it, the "we never saw it" defense is unavailable in a way it might be for a human artist. Access is baked into the training set.

This is why savvy builders treat output as something to be cleared, not just generated. The practical mitigations are unglamorous: run outputs against similarity/plagiarism checks before commercial use, avoid prompting for named copyrighted characters or artists when you intend to ship the result, and understand that "the AI made it" is not a defense — the human who publishes is the one the law reaches. It's also why the enterprise indemnities discussed later are scoped so carefully: providers will often stand behind outputs only if the customer used the tool as directed and did not deliberately prompt toward someone else's IP.

Why the two questions keep getting merged

The conflation is understandable because both questions surface in the same lawsuit and the same headline. A creator sues; the complaint alleges both that their work was used to train and that the model now produces competing output. So "AI copyright" gets discussed as one blob. But the remedies differ. The input claim, if it wins, is about compensation for the copying — licensing, damages. The output question is about who owns the new thing — and the usual answer, "no one fully owns raw machine output," doesn't compensate anyone; it just means the output is weakly protected.

Keeping them separate also clarifies incentives. Notice that these two answers create a strange equilibrium: developers want training to be fair use (so they don't pay for inputs), but users want output to be ownable (so they can build businesses on it). The law, as it stands, leans toward "training may be permissible, output is weakly protected" — roughly the opposite of what a naive "if it's legal I own it" intuition predicts.

Where this is actually heading: licensing

Here's the tell. Rather than bet everything on fair use, the largest developers have increasingly signed licensing deals — with publishers, image libraries, forums, and media archives — to get clean, permissioned training data. That behavior is more informative than any prediction. You don't pay for something you're confident is free.

Two forces push this way. First, legal risk pricing: litigation is expensive and uncertain, and a license converts an unknown liability into a fixed cost. Second, data quality: licensed, well-labeled, rights-cleared data is often simply better than scraped data, and as the open web fills with model-generated sludge, provenance-clean data gets more valuable. The likely long-run shape isn't "training is banned" or "training is free" — it's a licensing market, with fair use covering the genuinely transformative uses and contracts covering the rest. If you want the economic backdrop for why developers optimize every input cost this hard, see AI inference cost economics.

But notice what the licensing market does not do, because it's easy to over-read the trend. A licensing market solves the problem for whoever can afford to sit at the table — large platforms, big publishers, catalog owners. It does comparatively little for the individual creator whose work was one of billions of scraped items, and whose bargaining power alone is roughly zero. The plausible structures for reaching the long tail are collective: something like the collective-licensing and performing-rights organizations that already exist in music, where a body licenses a catalog on behalf of many creators and distributes revenue. Whether those institutions emerge for text and images, and whether they distribute fairly, is one of the genuinely open governance questions — and it's a policy question, not a doctrinal one. The law can declare training compensable without solving who gets paid how much; that machinery has to be built.

There's also an asymmetry the licensing narrative can obscure: licensing deals are often struck after models were already trained on the open web. A deal for future, higher-quality data does not necessarily concede that the earlier scraping was unlawful, and companies are careful to avoid that admission. So the rise of licensing is strong evidence about risk pricing and data quality, but weaker evidence about what the law will ultimately hold — a point worth keeping in view before treating "they're paying now" as proof that "they had to pay all along."

Synthetic data and the "clean data" arms race

One response to the whole copyright problem is to try to route around it: train on synthetic data — text, images, or code generated by other models — so that, in theory, no human-authored copyrighted work sits in the corpus at all. It's an appealing idea and a partial answer, but it carries its own subtleties that make it less of an escape hatch than it looks.

First, the provenance regress. Synthetic data is only "clean" if the model that produced it was itself clean — and today's generator models were largely trained on scraped human data. So synthetic data can launder copyright provenance in appearance while carrying the same memorized fragments in substance: if the generator memorized a passage, its "synthetic" output can reproduce that passage. Calling data synthetic doesn't sever it from the copyrighted source that shaped the generator. Second, the ownership question rebounds: if the output of a model is generally weakly protected (Question two), then a synthetic training corpus is itself largely unowned, which is fine for the trainer but means there's no new proprietary asset created. Third, and most technically consequential, is model collapse — training models on the output of models, iterated, tends to degrade quality and diversity, narrowing the distribution and amplifying artifacts. Synthetic data is a powerful supplement (for coverage, for rare cases, for privacy-sensitive domains) but a poor sole diet, which is precisely why the demand for fresh, licensed, human-authored data hasn't evaporated. The arms race isn't "synthetic replaces real"; it's "real, rights-cleared, provenance-tracked data becomes a premium input that synthetic data extends rather than replaces."

Provenance, watermarking, and content credentials

If the copyright fights of the last few years have a common root cause, it's the collapse of provenance — the ability to know where a piece of content came from, who made it, and what rights attach. Scraping at web scale strips that metadata; generation at web scale manufactures content with no inherent origin. A lot of the emerging technical infrastructure is an attempt to rebuild provenance, and it's worth understanding what each mechanism can and can't do, because they are frequently oversold.

Content credentials and signed provenance. The most mature effort is cryptographically signed metadata attached to a file at creation — a tamper-evident manifest recording what tool made it, whether AI was involved, and the edit history (the C2PA / "content credentials" family of standards). This is genuinely useful for the authorship and disclosure side: it lets a creator assert "a human made this with these tools" or "this is AI-generated," and it travels with the file. Its hard limit is that metadata can be stripped — a screenshot, a re-encode, or a platform that discards metadata erases it. Signed provenance proves origin when present; it cannot prove absence of manipulation once the signature is gone. It's an assertion mechanism, not a detection mechanism.

Watermarking. Watermarking embeds a signal into the content itself — imperceptible perturbations in an image, statistical biases in generated text — so that a detector can later flag "this came from model X." It survives some transformations that strip metadata, which is its advantage. But text watermarking is fragile against paraphrasing and editing, image watermarking can be degraded by cropping/filtering/re-generation, and every scheme faces an adversary who specifically wants to remove it. Watermarking is best understood as raising the cost of passing off AI content or of scrubbing origin — not as a reliable, court-grade proof. Treat any claim of "unremovable watermarking" with suspicion.

Robots directives and opt-out signals. On the input side, the provenance question is inverted: not "who made this?" but "who is allowed to train on this?" Machine-readable opt-out signals (extended robots directives, TDM reservation metadata, per-file rights expressions) are the mechanism creators use to say "no training." In opt-out jurisdictions these carry legal weight; everywhere, honoring them is the cheap way to stay defensible. Their weakness is enforcement — a signal only helps if crawlers respect it and if you can detect when they don't.

Put together, these tools point toward a future where content carries rights and origin data as a first-class attribute rather than as an afterthought — but none of them is a silver bullet, and anyone who tells you watermarking "solves" AI attribution is selling something. The realistic framing: provenance infrastructure shifts the defaults and raises costs at the margin, which is meaningful at scale, while leaving determined bad actors able to strip signals. It's plumbing that makes the honest path easier, not a lock that makes the dishonest path impossible.

What creators and builders can actually do

You can't control the case law. You can control your own exposure. Split your actions by which question they address.

If you're a creator worried about your work being trained on (input side):

  • Use machine-readable opt-outs. Robots directives, TDM opt-out signals, and platform-level "do not train" settings are increasingly honored — and in opt-out jurisdictions they carry legal weight. They only work if you actually set them.
  • Keep provenance records. Timestamps, originals, and publication history make it far easier to assert rights or negotiate later.
  • Read platform terms. Many "free" hosting platforms grant themselves broad rights to use your uploads for training. The training may be happening through a license you clicked.

If you're building products with AI output (output side):

  • Add a genuine human layer. Selection, editing, arrangement, and iteration aren't just quality steps — they're what makes your work protectable. Treat raw output as raw material.
  • Don't assume you own raw generations. For anything where exclusivity matters — logos, brand assets — assume raw output is weakly protected and build human authorship in, or commission traditionally.
  • Read your vendor's indemnity. Some providers now indemnify enterprise customers against copyright claims on outputs. That clause is a real allocation of risk — know whether you have it.
  • Log provenance for your own outputs and inputs. Which model, which prompt, which reference material. If a dispute arises, "we can show our process" is worth a lot.
  • Clear high-stakes outputs before shipping. For anything commercial and public-facing, run outputs through similarity checks and avoid prompting toward named artists or copyrighted characters. Remember the third question: your output can infringe someone else's work even if training was legal and even if you can't own the output yourself.

None of this requires predicting how any particular case resolves. It requires treating the two questions as two questions — three, once you count output infringement — and doing the boring hygiene that keeps you out of the blast radius of any of them.

What is genuinely unsettled

A piece like this earns trust by being clear about the boundary between what's durable and what's genuinely up for grabs. The framework above — input vs output, fair use vs TDM, memorization as the crux, human authorship as the bar — is stable and unlikely to be overturned. But several load-bearing questions are honestly open, and anyone who states them with confidence is guessing. As of writing:

  • Whether non-expressive training is categorically fair use, or fact-specific forever. The strongest developer position is that learning statistical patterns is transformative per se. The strongest rightsholder position is that market harm (especially the "lost licensing market") drags it back case by case. It is not settled which framing courts will generalize, and the answer may differ by content type (code vs prose vs images vs music).
  • Whether the "lost licensing market" theory of harm is legitimate or circular. If rightsholders can manufacture a market simply by demanding to be paid for training, factor four collapses toward plaintiffs; if courts reject that as bootstrapping, it favors developers. This single question may decide more cases than any other.
  • How much human contribution is "enough" for output protection. Everyone agrees pure one-prompt output is unprotectable and heavily-edited composites are protectable. The vast middle — extensive prompting, iterative refinement, curation among thousands of generations — has no bright line, and registration practice is still being worked out.
  • How memorization thresholds map onto liability. No court has drawn a clean line at which "the model can be made to emit training data" becomes infringement, nor settled who is liable when it does — the developer who trained it, or the user who prompted it out.
  • Whether output watermarking or provenance will ever be reliable enough to matter legally. The technical arms race between marking and stripping has no stable equilibrium in sight.
  • How the jurisdictional patchwork resolves for globally deployed models. Territorial copyright plus borderless deployment is an unstable combination, and it's unclear whether it converges toward the strictest regime, the most permissive, or a licensing layer that papers over the difference.

The honest posture is to build on the durable structure and hedge on the open questions — which, conveniently, is exactly what the provenance-logging, opt-out-respecting, human-in-the-loop hygiene above is designed to do. It doesn't require you to predict the winner; it keeps you defensible whichever way each question breaks.

FAQ

Is it illegal to train an AI on copyrighted data? Not settled, and it varies by jurisdiction — but it's generally analyzed as fair use in the US or under text-and-data-mining exceptions elsewhere, and courts have been broadly sympathetic to the act of training when the use is transformative and the output doesn't substitute for the originals. The risk rises sharply when a model reproduces training data near-verbatim or generates direct market replacements for the works it learned from.

Can I copyright something an AI generated for me? Purely AI-generated output, with no meaningful human creative input, is generally not copyrightable in most jurisdictions, because copyright protects human authorship. You can, however, protect the parts you creatively contributed — substantial editing, selection, arrangement, or the larger human-authored work the output sits inside. Raw one-prompt outputs used as-is are the weakest case.

Does writing a detailed prompt give me copyright over the result? Usually not on its own. Prompts are typically treated as ideas or instructions rather than protectable authorship, and instructing a machine isn't the same as authoring the output. Detailed prompting improves your results, but ownership generally comes from human creative contribution to the final work, not from the cleverness of the request.

What is "memorization" and why does it matter legally? Memorization is when a model stores and can reproduce specific training examples rather than just learning general patterns. It matters because a model that emits verbatim copies of its training data is doing something that looks a lot like copying, which weakens the fair-use argument regardless of intent. It's why developers invest in deduplication and output filtering.

If AI training is fair use, does that mean the output is free to use? No — these are separate questions. Whether training was legal says nothing about who owns the output. Even if training is fully permissible, raw machine output is generally weakly protected, and separately, an output could still infringe if it closely reproduces a specific copyrighted work. Legal training does not launder an infringing output, and it doesn't grant you ownership.

Why are AI companies signing licensing deals if training might be fair use? Because a license converts uncertain legal risk into a fixed, predictable cost, and because rights-cleared data is often higher quality than scraped data. The willingness to pay signals that developers don't consider the fair-use question settled in their favor — and it points toward a future licensing market rather than either a ban or free-for-all. Read it carefully, though: many deals cover future data and don't concede that earlier scraping was unlawful, so they're strong evidence about risk pricing but weaker evidence about how the law will ultimately land.

Can an AI output infringe someone else's copyright even if I can't own it? Yes — this is the point most people miss. "Can I own it?" and "does it infringe someone else's work?" are separate questions. A generation can be simultaneously unprotectable (you didn't author it) and infringing (it reproduces protected expression from a third party). If a model returns something substantially similar to a specific copyrighted character, image, song, or block of code, publishing or selling that output can be infringement — and "the AI made it" is not a defense. The person who commercializes the output is the one the law reaches, which is why clearing high-stakes outputs matters.

Does using copyrighted material as a style reference infringe? Style itself is generally not protected by copyright — you can imitate an aesthetic, a genre, or a technique without infringing, because copyright protects specific expression, not ideas or styles. The risk arises when the output reproduces protected expression: an identifiable composition, characters, or passages from a particular work, rather than a general resemblance. "In the style of" is legally safer than "a copy of," but prompting a model to closely reconstruct a specific work — or a distinctive, recognizable character — moves you from homage toward copying, and other rights (trademark, publicity) can attach even where copyright doesn't.

Is training legal in one country but not another? Yes, and the differences are structural, not cosmetic. The US uses open-ended fair use; the EU and much of the world use enumerated text-and-data-mining exceptions, several of which let rightsholders opt out in a machine-readable way; some jurisdictions (such as Japan) are notably permissive for training, while others (such as the UK, as of writing) allow only narrow non-commercial mining. Copyright is also territorial, so where you deploy a model — not just where you trained it — can determine which country's law applies. "Is training legal?" only has an answer once you specify the jurisdiction, the market, and the opt-out obligations.