Somewhere in your training pipeline sits a dataset whose source note reads, in effect, “we found it on the internet”. That note is doing a lot of work, and none of it is legal work.
The assumption underneath is simple and wrong. If a page loads without a password, the thinking goes, the public data on it is fair game.
Being able to see something is not the same as being allowed to use it. A page you can reach is an address, not a grant, and five separate systems of law each get a say over public data.
Any one of them can say no. This piece walks all five public data layers, in the order they tend to bite.
Key Takeaways
- Public data is an address, not a permission. Five separate legal systems govern reuse, and clearing four of them still leaves you exposed on the fifth.
- Provenance decides copyright cases. Judge Alsup held training on lawfully bought books was fair use and keeping seven million pirated copies was not. Anthropic settled that second half for $1.5 billion.
- Terms of service survive where hacking law fails. hiQ beat LinkedIn on the computer-misuse claim and still lost the case, settling with a permanent injunction.
- Data protection ignores visibility entirely. In July 2026 the EDPB stated that public availability is neither consent nor a legal basis for scraping personal data.
- A reserved right travels with the file. Under EU law a machine-readable opt-out blocks commercial mining, and a German appeal court confirmed in December 2025 that a natural-language notice is not enough.
- No US appeals court has ruled on training as fair use yet. Every framework in this piece is provisional, which is exactly why your records matter.
Quick Navigation
- Why "Publicly Available" Became a Public Data Myth
- The Permission Stack: Five Systems That Govern Public Data
- Layer One: Copyright Does Not Switch Off for Public Data
- Layer Two: Terms of Service Bind Public Data Users
- Layer Three: Access Law and the Public Data Login Line
- Layer Four: Data Protection Ignores Public Data Visibility
- Layer Five: Reserved Rights Travel With Public Data
- A Timeline of Rulings That Reshaped Public Data
- Clearing the Stack: A Public Data Provenance Record
- The Verdict: Public Data Is an Address, Not a Permission
- Frequently Asked Questions
Why “Publicly Available” Became a Public Data Myth
The belief has an honest origin. For twenty years, indexing the open web was normal, and search engines built huge businesses on public data nobody licensed to them.
Generative models broke that truce. Indexing points people at a source. Training swallows the source and can compete with it, and courts now treat the two uses of public data very differently.
Volume changed things too. Pulling a thousand pages of public data for a price check looks nothing like ingesting billions of documents, and regulators react to scale even when the act is the same.
So the old instinct survives in engineering teams while the law on public data shifts underneath it. That gap is where the risk lives.
The Permission Stack: Five Systems That Govern Public Data
Think of public data rights as a stack, not one question. Each layer runs on different law, gets enforced by different people, and can stop you on its own.
| Layer | What it controls | Who enforces it | Veto power |
|---|---|---|---|
| Copyright | Copying and derivative use | Rightsholders, courts | Damages, injunction |
| Contract | Terms you accepted | Site operators | Breach claim, injunction |
| Access law | How you reached the data | Prosecutors, site operators | Criminal and civil exposure |
| Data protection | Personal information inside it | Regulators | Fines, deletion orders |
| Reserved rights | Opt-out signals on the source | Rightsholders, AI regulators | Loss of the mining exception |
Notice what the table implies. A clean copyright answer on public data does nothing for you if the privacy layer fails, and those fines do not care how clever your model is.
Layer One: Copyright Does Not Switch Off for Public Data
Start with the most fought-over layer. Copyright attaches to original work the moment it is made, and turning it into public data by posting it waives nothing.
An unmarked blog post is as protected as a hardback. A Creative Commons licence is still a licence, with terms you can break. Only a real public domain dedication, or expiry, takes public data out of copyright.
What the 2025 Rulings Actually Held
Two public data decisions landed days apart in the Northern District of California. Both are narrower than the headlines suggested.
In Bartz v. Anthropic, Judge Alsup held on 23 June 2025 that training on lawfully bought books was fair use. He called it spectacularly transformative. In the same order he held that downloading and keeping more than seven million pirated copies was not.
Anthropic settled that second half for $1.5 billion, approved on 20 July 2026. It is the largest copyright settlement on record in the United States.
Two days later in Kadrey v. Meta, Judge Chhabria also found training transformative. His reason differed, though: the authors had failed to show market harm with evidence the court could accept. He said plainly that a better record might have flipped the result, and claims about Meta’s torrent seeding survived.
Where Public Data Provenance Decides the Case
Read together, those rulings say something narrow and useful about public data. How you got the material matters more than what you did with it.
That is the lesson for anyone building a public data corpus. A lawful copy feeding a new use has a real defence. An unlawful copy has none, however good the model that ate it.
The position is far from settled. As of late 2026, no US appeals court has ruled on training as fair use. Thomson Reuters v. Ross is furthest along at the Third Circuit, and the New York Times case against OpenAI is still live.
Veto power: damages and court orders, with wilful infringement exposure of up to $150,000 per work.
Layer Two: Terms of Service Bind Public Data Users
The second public data layer is the one engineering teams skip, and it has the best record in court.
Most sites carry terms that ban automated collection. A posted notice can bind you. Making an account and clicking agree binds you far more tightly.
Here is the part that surprises people. Contract claims often survive where the hacking claim collapses, because a broken promise is a separate wrong from a break-in.
hiQ Labs is the standard example. It won the famous ruling that scraping public profiles did not breach the federal computer-misuse statute, then lost on LinkedIn’s contract claims and settled in December 2022 with a permanent injunction.
So the order matters. Win the access argument, lose the contract argument, and a court still shuts your public data pipeline down.
Veto power: breach claims, court orders, and account closure that kills your pipeline overnight.
Layer Three: Access Law and the Public Data Login Line
The third layer asks how you reached the public data, and US law has settled into a fairly clear rule.
The Supreme Court narrowed the Computer Fraud and Abuse Act in Van Buren in 2021. After that case and hiQ, reading genuinely public pages without logging in sits outside the statute in most cases.
Cross a login and the picture changes. A password marks a boundary, and slipping past one looks very different to a court than reading public data anyone can see.
Meta v. Bright Data sharpened the line in 2024. Public data scraped while logged out, after the accounts were closed, did not break the terms, because those terms covered logged-in conduct.
That gives you a workable engineering rule. Log out and stay out. Treat any password, rate-limit dodge or paywall bypass as a call for legal sign-off, not a sprint ticket.
Veto power: criminal risk at the extreme, and civil claims for getting past technical controls.
Layer Four: Data Protection Ignores Public Data Visibility
Now the public data layer that catches the most teams, because it runs on a logic the other four do not share.
Privacy law never asks whether the data was visible. It asks whether the data identifies a person. If it does, you need a lawful basis before you touch it.
What the EDPB Said in July 2026
On 7 July 2026 the European Data Protection Board adopted Guidelines 03/2026 on web scraping for generative AI. It is the first EU-wide framework aimed squarely at this practice, and the draft is open for comment until 30 October 2026.
Three points matter to anyone building a public data corpus. Consent is not workable at scale, so legitimate interest carries the weight and must survive a written three-part test. Sensitive data, faces included, is close to banned without a separate exemption.
The guidance also weighs whether the source site put technical blocks in place. Ignoring a block is no longer a neutral engineering choice.
The enforcement record backs this up. Clearview AI ran up roughly €100 million in European fines for scraping public data photographs, including €30.5 million from the Dutch regulator, and the UK Upper Tribunal revived the British case in October 2025.
France’s regulator went further on much plainer facts. It fined the contact-data firm KASPR €240,000 and ordered 160 million records deleted. Work profiles on a social network, it held, are not “manifestly made public” in the sense the law means.
The Deletion Problem Public Data Creates
One public data consequence deserves its own paragraph, because it changes system design rather than paperwork.
A person can ask you to erase their data. Once that data has shaped model weights, there is no clean way to do it. A late request becomes an early design problem.
That is the real reason to record where your public data came from before training, not after. We covered the adjacent question of what regulators actually accept as proof in our piece on AI compliance evidence.
Veto power: fines up to €20 million or 4% of global turnover, plus orders to delete.
Layer Five: Reserved Rights Travel With Public Data
The final public data layer is the newest, and in Europe it has teeth that surprise American teams.
Article 4 of the EU copyright directive allows commercial text and data mining of lawfully accessible works, unless the owner has reserved the right in a machine-readable way. Reserve it properly and the exception vanishes, so mining that public data in the EU needs a licence.
Two words there carry weight. “Lawfully accessible” is not the same as visible. Paywalled material, and content behind terms that ban mining, sits outside the exception even when your crawler can reach it.
The Hamburg appeal court tightened the other half in December 2025. Ruling in the LAION case, it held that a reservation written in plain words inside terms of use is not enough. A machine has to spot the signal and act on it, with no human reading required.
That ruling cuts both ways, and honest coverage should say so. Site owners relying on a copyright footer get no public data protection, while crawlers can no longer claim a written notice was unclear.
The EU AI Act then ties the two together. General-purpose model providers must keep a copyright policy that respects machine-readable reservations, and publish a training data summary. The Commission’s powers to fine arrived in August 2026. We mapped those duties in our guide to the GPAI obligations.
Veto power: loss of the mining exception, plus AI Act fines reaching €15 million or 3% of turnover.
A Timeline of Rulings That Reshaped Public Data
Five years of decisions, compressed. Each one moved a different layer of the public data stack.
| Date | Decision | What it moved |
|---|---|---|
| Jun 2021 | Van Buren v. United States | Narrowed US computer-misuse law |
| Dec 2022 | hiQ v. LinkedIn settlement | Contract claims outlive access claims |
| May 2024 | Dutch fine on Clearview AI | Public photos are still personal data |
| Dec 2024 | CNIL decision on KASPR | Profiles are not “manifestly made public” |
| Feb 2025 | Thomson Reuters v. Ross | Licensing markets weigh against fair use |
| Jun 2025 | Bartz and Kadrey | Provenance splits from purpose |
| Dec 2025 | Hamburg ruling in LAION | Opt-outs must be machine-actionable |
| Jul 2026 | EDPB Guidelines 03/2026 | Public availability is not a legal basis |
Read down the right column and a pattern appears. Every decision closed a public data shortcut that engineering teams had been leaning on.
Clearing the Stack: A Public Data Provenance Record
None of this needs a lawyer for every crawl. It needs a record, attached to the dataset, that answers the questions a court or regulator would ask about your public data.
Capture six fields per public data source, at collection time, because rebuilding them later is close to impossible.
- Source and date. The exact domain and the collection dates, not “the web” and “2025”.
- Access method. Logged out or logged in, and whether you hit any rate limit, paywall or block.
- Terms status. A dated copy of the terms in force on the day you collected, since sites revise them quietly.
- Robots and reservation signals. What the robots file and any rights headers said on the collection date, stored as fetched rather than summed up.
- Personal data check. Whether the source holds personal data, and if so, the lawful basis and the legitimate interest test you wrote down.
- Licence chain. For bought datasets, the upstream licence and what the vendor promised, because buying public data does not buy you a defence.
Two habits make the record usable. Keep block lists, so a removal request also covers future crawls. Re-check reservation signals instead of trusting an eighteen-month-old snapshot.
US states are layering their own rules onto personal and biometric public data too, which our review of the state AI law patchwork covers in more detail.
The Verdict: Public Data Is an Address, Not a Permission
- Go back to that source note. “We found it on the internet” answers a question about where the public data sits, and nothing else.
- The five layers each ask something different. Who owns it, what did you promise, how did you reach it, whose personal details sit inside it, and did anyone reserve their rights.
- Public data clears all five or it clears none, and the weakest layer sets your exposure. That is why a strong fair use argument offers no comfort when the issue is a scraped face.
- None of this is settled, and anyone telling you otherwise is selling something. No US appeals court has ruled on the central public data question, the EDPB guidance is still in consultation, and AI Act enforcement is months old.
- Which is the argument for writing things down now. When the law firms up, teams that can show where every public data file came from will be in a very different position from teams that cannot.
This piece is general information about a fast-moving area of law, not legal advice. Take advice on your specific corpus.
Frequently Asked Questions
Is public data free to use for AI training?
No. Public data describes access, not permission. Copyright still applies to material posted online, site terms may ban collection, privacy law governs any personal details inside it, and in the EU a machine-readable rights reservation can remove the mining exception entirely.
Does scraping public data break the law?
It depends on which layer you touch. Collecting non-personal public data while logged out is broadly defensible in the US. Scraping personal data brings privacy duties in Europe no matter how visible it was, and crossing a login moves you into contract and access-law territory.
What did the Bartz v. Anthropic ruling decide about public data and books?
Judge Alsup held on 23 June 2025 that training on lawfully bought books was fair use. Downloading and keeping more than seven million pirated copies was not. Anthropic settled that second half of the public data question for $1.5 billion, approved in July 2026.
Does robots.txt have legal force for public data?
In the EU it can. A machine-readable reservation under Article 4(3) of the copyright directive pulls that public data out of the commercial mining exception, and a robots file aimed at AI crawlers qualifies. In the US it carries no direct legal force, though ignoring it reads badly as evidence of intent.
Can we rely on legitimate interest to scrape personal data?
Sometimes, with work. The EDPB’s July 2026 guidelines treat legitimate interest as the main basis for public data scraping, while requiring a written three-part test, data minimization, transparency and the exclusion of sensitive categories. Consent is not realistic at scraping scale.
Keep reading
Here are the latest posts from the blog.
Kimi K3.1 Pro vs Sonnet 5.5: Same Price, Different Bill
RAG vs Fine-Tuning: Which One You Actually Need
AI Infrastructure Spending: What $145 Billion and a Sold-Out AWS Actually Buy
