Your AI vendor said the training data was properly licensed

The Federal Trade Commission announced three enforcement actions against major AI model vendors on 19 August 2026, concluding settlements involving a major generative AI provider, an image generation platform, and an industry-specific model provider.

In each case, the FTC investigation found that the vendor had publicly stated, in marketing materials, documentation, or customer disclosures, that training data was properly licensed or in the public domain. Investigation revealed substantial portions of training data actually came from unauthorised web scraping and included copyrighted material used without copyright holder permission.

The FTC’s theory: this is an unfair and deceptive trade practice under the FTC Act. Vendors made material misrepresentations about product characteristics that would affect customer purchasing decisions and liability exposure. A customer who chose a vendor because it claimed ethically sourced training data, when that data was actually infringing, was deceived.

“Data is properly licensed.” Vendors claimed training data was licensed from content providers with permission. In reality, 30 to 40 per cent of training data in the investigated cases came from unauthorised web scraping, and licenses had not been obtained for most of it.

“Data is public domain or open-source.” Vendors claimed training data was sourced from public domain and open-source repositories where use is permitted. In reality, vendors had scraped copyrighted news articles, academic papers and creative works from public websites. Presence on a public website does not make content public domain.

“Use qualifies as fair use.” Vendors claimed transformative AI training constitutes fair use under U.S. copyright law. In reality, vendors extracted verbatim sections of copyrighted text and code in model outputs. That is reproduction, not transformation, and the fair use defence failed.

In each case, FTC investigation revealed a consistent pattern: automated web scraping without permission from content owners, no verification of whether scraped content was licensed or public domain, substantial copyrighted material folded into training data including news articles, academic papers, published books, photographs, creative writing and source code, no notification to copyright holders before use, and in some cases model outputs reproducing training data nearly verbatim.

Copyright holders discovered the use of their work only when it appeared in model outputs, not through any notification from the vendor.

The three settlements impose ongoing obligations on vendors:

• Third-party audit of training data provenance: independent auditors must certify or refuse to certify that data was obtained with appropriate permissions, annually for five years.
• Data inventory and provenance records: detailed records showing the source of each training data component, licensing status, and whether it includes copyrighted material.
• Identification and notification of infringing content: vendors must analyse training data to identify copyrighted material used without permission and notify the copyright holders.
• Customer notification: vendors must notify all customers who purchased models based on the misrepresented training data, disclosing that infringing content was included and that FTC enforcement concluded.
• Refunds or termination rights: customers who relied on training data representations may be entitled to a refund or to terminate the contract without penalty.

The settlements require vendors to actively identify which training data is copyrighted and notify affected customers. That means vendors will soon be sending notices along the lines of: your model was trained on data that included copyrighted material from named publishers or authors, and recommending customers audit model outputs for verbatim copying, review indemnity provisions, and take legal advice on liability exposure.

Historically, customers could argue they relied on vendor representations and the vendor bore the risk. After these settlements, customers have explicit notice that infringing content is in the model, and continuing to use it after that notice is a decision the customer now owns.

If you license AI models from vendors, your agreements need three sections:

• Training data warranty: an unqualified warranty that training data was obtained with appropriate permissions and does not include substantial copyrighted material obtained without permission, with refund or termination rights if breached. Push back on vendor attempts to qualify this with “to the best of vendor’s knowledge.”
• Audit rights: the right to conduct or commission independent audits of training data provenance and copyright compliance, with vendor cooperation and documentation. Push for reasonable audits at any time, or annual audits at the vendor’s expense.
• Indemnity for FTC liability and copyright claims: indemnity against any FTC enforcement action or settlement arising from the vendor’s training data practices, and against copyright infringement claims arising from the customer’s use of the model where the infringing content sits in the vendor’s training data.

Review your existing vendor agreements now. If one says “we cannot warrant training data sourcing,” treat that clause as material risk and ask the vendor to either provide training data warranties or agree to refund or termination if FTC enforcement later concludes the training data is infringing.