Before you buy training data, make five checks: read the dataset's documentation, trace its rights to the original sources, read what the license allows for models and outputs, find any personal data and the promises it was collected under, and measure a sample. Then agree how new versions, corrections and deletions reach your copy. This note is research, never legal advice.
Labels on dataset platforms are often wrong. A 2024 audit of 1,858 fine-tuning datasets found that "more than 70% of licences for popular datasets on GitHub and Hugging Face are ‘unspecified’" [6]. It also found 66% of the Hugging Face licenses it analyzed in a different use category from the author's original, often a more permissive one [6].
Before you buy training data, read its datasheet
Datasheets for Datasets proposed in 2018 that every dataset come with a datasheet documenting "its motivation, composition, collection process, recommended uses, and so on" [1]. Put its questions to any seller. Over what timeframe was the data collected? Were the people in it notified, and did they consent? Have third parties imposed IP-based or other restrictions? Is there an erratum, and do older versions stay available [1]?
Machine-readable formats carry the same answers. MLCommons' Croissant format has a license field that recommends the URL of a known license, and a versioning scheme in which a new major version means existing records were edited, removed or moved between splits, or the data was extended in a way that breaks access to the previous version [3]. Croissant RAI adds fields for personal and sensitive information, intended uses and the collection time frame [2]. The Data & Trust Alliance's provenance standards define 22 metadata fields, among them data origin geography, consent documentation location and license to use [4]. The Alliance notes they "do not guarantee compliance with any particular data protection law" [4].
One cloud marketplace's publishing guidelines require listings to be accurate and to "note if any data has been aggregated or anonymized", and leave how subscribers may use the data to the subscription agreement [25]. Ask for the datasheet as well as the listing. Record-level fields go further, as datasets that state their limits sets out.
Trace the rights back to the original source
A dataset's license states what its publisher claims. A 2025 study traced nearly 4,000 public text, speech and video datasets back through their derivations [7]. Under 33% were restrictively licensed, while over 80% of their source content carried non-commercial restrictions [7]. The 2024 audit describes "a crisis in licence laundering" in popular datasets [6]. Ask for the upstream agreements, which FISD lists among the documents for verifying a vendor [35].
A 2024 audit of 14,000 web domains found that, in a single year, new restrictions left about 5% or more of all tokens in C4, the Colossal Clean Crawled Corpus of web text [27], fully restricted from use [8]. Ask when the data was collected and which robots.txt rules and terms of service applied then.
How the data was obtained matters on its own. The U.S. Copyright Office's pre-publication report of May 2025 says "the knowing use of a dataset that consists of pirated or illegally accessed works should weigh against fair use without being determinative" [13]. In June 2025, a federal district court, ruling on summary judgment in a suit by authors against a model developer, held that the training use was a fair use, and sent the pirated library copies to trial, writing that "The downloaded pirated copies used to build a central library were not justified by a fair use" [14]. That is one court's order.
The EU's voluntary General-Purpose AI Code of Practice [36] commits the model providers that sign it to crawlers that follow robots.txt as specified in RFC 9309, respect paywalls and skip sites recognized as persistently infringing [17]. Put the same three questions to a seller of crawled data.
What the license lets you do with a model
Licenses written for machine learning separate rights that general licenses run together. The Montreal Data License taxonomy (2019) treats research, internal use of outputs, selling outputs and shipping the trained model as distinct rights [9]. Ask which of those four the license grants.
Some licenses answer directly. CDLA-Permissive-2.0 "does not impose any restriction or obligations with respect to the use, modification, or sharing of Results", and its Results include machine learning models [10]. It also provides the data "AS IS", without warranties of title or non-infringement [10]. Creative Commons' conservative guidance, which it says is "likely to lead to overcompliance", reads NonCommercial as requiring that "all stages, from copying the data during training to sharing the trained model, must not be for commercial gain" [11].
Fine-tuning and training can be separate rights. A March 2026 buy-side paper from FISD's Alternative Data Council, written for data vendors on how investment firms use licensed data, defines fine-tuning as adapting an existing model and model training as building a new one, "a more intensive use of source data" [12]. It reports that some vendors now seek deletion duties at termination that extend to "model artifacts" which may embed licensed data [12]. License terms in depth are in what a training data license grants.
Personal data and the promises behind it
Regulators have ordered models deleted along with data. A 2021 FTC order required a photo app developer to delete "the models and algorithms it developed by using the photos and videos uploaded by its users" [19]. A 2024 order required a seller of location data to run a supplier assessment program checking that its suppliers obtained informed consent [18].
FTC staff wrote in February 2024 that adopting more permissive data practices and telling consumers only through "a surreptitious, retroactive amendment to its terms of service or privacy policy" may be unfair or deceptive [20]. Ask which privacy policy and terms applied when each part was collected. The European Data Protection Board says supervisory authorities should consider whether a controller deploying a model made an appropriate assessment that it "was not developed by unlawfully processing personal data" [21]. The opinion concerns models, and a data buyer faces the question one step earlier.
De-identification has limits. A 2019 study estimated that "99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes" [22]. A trained language model can also emit names, phone numbers and email addresses that appeared in one document of its training data [23]. Since 1 August 2026, California data brokers must access the state's deletion mechanism at least once every 45 days and process consumer deletion requests [24]. Ask how deletions reach copies already delivered.
Test a sample before you sign
Published studies show what to look for. Duplicates: models trained on deduplicated data "emit memorized text ten times less frequently" [26]. Benchmark leakage: 4.6% and 5.7% of the examples in two evaluation sets appeared verbatim in C4 [27]. Label errors: ten benchmark test sets averaged an estimated 3.3% label errors or more [28]. Unusable text: of 205 web-crawled language corpora audited, at least 15 held no usable text [29]. Model-generated content: indiscriminate training on it "causes irreversible defects in the resulting models" [30], so ask how much of the dataset is synthetic. Where records describe people or companies, check the sample for duplicate entities, as in how entity resolution matches records across sources.
A clean sample proves less than it seems. With NIST's exact binomial method, zero defects in 200 records still allows a true defect rate up to 1.83% at 95% confidence (derived) [31]. The same arithmetic sizes the pilot in how to test document extraction accuracy before you buy.
What you may have to disclose later
Your own disclosure duties turn into questions for the seller. California's AB 2013, as enacted in 2024, requires developers of generative systems offered to Californians to post documentation of their training data, including its sources or owners and "Whether the datasets were purchased or licensed by the developer" [33]. It counts fine-tuning as training [33]. Under the EU AI Act, providers of "general-purpose AI models" must publish a summary of their training content on the AI Office's template [15]. The template treats datasets licensed from rightsholders apart from private datasets obtained through intermediaries [16]. Providers of general-purpose models placed on the market before 2 August 2025 must comply by 2 August 2027 [15].
Repeat the checks after onboarding
Diligence goes stale. In April 2022, SEC examination staff observed advisers that onboarded alternative data providers but "did not have a system for determining when due diligence needed to be re-performed based on passage of time or changes in data collection practices" [34]. The alert states staff views, not a rule [34]. A seller's statements can also be false. In 2021 the SEC charged an alternative data provider that had told companies their data would be aggregated and anonymized, while it "used non-aggregated and non-anonymized data to alter its model-generated estimates", a case settled without admitting or denying the findings [32]. Recheck at each new version: in Croissant, a new major version means existing records changed or the previous version can no longer be read as before [3].
On Rillor's data marketplace, ready-made datasets are licensed for model training and research under a written data agreement that sets use, term and onward sharing before access starts, and each delivery names its version and comes with a change log and a datasheet.
Read the full report
The full report gives each check its evidence, sets the datasheet questions and license rights out in tables, ends its findings with a checklist table and lists every source.