Training AI Models On Copyrighted And Personal Data - Reconciling Fair Use And Privacy Rights

Author: LawSphereX

Category: Constitutional & Human Rights

Published: 2026-08-23T21:36:15.698996+00:00

Updated: 2026-08-26T17:05:14.104+00:00

TRAINING AI MODELS ON COPYRIGHTED AND

PERSONAL DATA: RECONCILING FAIR USE AND

PRIVACY RIGHTS

Bedanta De, KIIT School of Law, KIIT University Page: 8869 - 8885

1. ABSTRACT

Because of the fast advancements in generative AI, computers can now produce documents, pictures, music, and other content that resembles text written or made by people. A large portion of the information used to train these models is obtained from publicly available sources and contains a lot of copyrighted and personal data that people did not give permission for. It leads to legal debates regarding whether using such data is permitted by copyright law and privacy rules, especially since they are in the process of changing in India. Even though fair use and fair dealing are common arguments for AI training made by developers in the U. S. and India, they are coming under close inspection due to the privacy standards established by the Justice K. S. Puttaswamy v. Union of India which recognized the Right to privacy as a fundamental right under Article 21 of the Indian Constitution.

Besides, India’s latest Digital Personal Data Protection Act, 2023 places stricter rules on gathering, processing, and consent to the company’s use of data, making it necessary to update AI systems. The paper examines the conflict between the use of copyrighted content in machine learning and the need to protect a person’s privacy, mainly when information in the data is sensitive. Looking at the differences among India, America, and Europe, the study offers a review of the regulations and describes what changes should be made. It supports openness in where the data is obtained, open consent policies, and policies that equally guard progress and rights in the age of AI.

2. Introduction

Generative artificial intelligence is the new buzzword that has changed the landscape of creativity, productivity, and innovation in recent years. Such systems as the OpenAI’s ChatGPT, Google Gemini, Anthropic Claude, and Stability AIS Stable Diffusion can produce human-like text, image, audio, and code data1. The machine models that enable such capabilities are trained on huge volumes of data including books, articles, art, websites, social media posts, and other publicly accessible or scraped data2. Nevertheless, the secrecy of the character and source of these data-files have made way to its strong legal discrimination especially concerning the aspect of copyright violations and unauthorized utilization of personal information3.

Underlying this legal strife is the fact that AI models frequently consume copyrighted material and Personally Identifiable Information (PII) without the requisite consent or license. The copyright regime ascertains the legitimacy of such use in regards to whether it is fair use (in countries such as the U. S. ) or fair dealing (as is the case under Indian law), and the generally accepted data protection laws challenge the validity of whether harvesting personal user data without their consent infringes on the individual, in terms of their right to privacy4. In India, this has been the most pertinent debate with the Supreme Court having made the landmark this year in the case of Justice K. S. Puttaswamy v.

Union of India, where the right of informational privacy was again held to be inherent in Article 21 of the Constitution5, the latest statute regarding the very securing of such the provision being the Digital Personal Data Protection Act 2023, which aims at putting in practical effect the principle of consent-based data processing6.

At the same time, in different jurisdictions, several lawsuits are created against big names in AI development. As an example, writers and musicians have claimed that their work that is under copyright has been deployed unauthorized to train AI that can now compete with human creations. In the privacy domain, there are concerns with law scholars and technologists about the harvesting of facial images, samples of voice recordings and the history of interactions with an AI company that could be used in identity theft, profiling or by causing reputational harm7. The purpose of this paper is to be able to critically analyse the legal and ethical paradox between the utilization of copyrighted and individual data to teach AI models and safeguards provided through the copyright and privacy laws.

It is most centred within India, and makes comparative observations concerning the fair use doctrine in the United States, the General Data Protection Regulation (GDPR) in the European Union, and other international case law. The goal is to de-mutualize and have a balance in which technological innovation becomes a possibility and yet constitutional and statutory rights, especially authorship, consent, and dignity are allowed to prevail.

3. Understanding AI Training Models and Their Data Sources

Generative Artificial Intelligence depends on machine learning algorithms, particularly large language models (LLMs) and generative adversarial networks (GANs), which cannot learn patterns, styles, and associations without access to vast datasets. The effectiveness and sophistication of these systems are heavily influenced by the comprehensiveness and diversity of the data on which they are trained1. In practice, this training data often includes publicly available information as well as copyrighted materials such as news articles, artwork, code repositories, personal blogs, and social media content scraped from the internet2. Generative AI functions differently from traditional software. While traditional software operates based on pre-written rules and logic, generative AI learns and generates outputs based on patterns in data.

For instance, models like OpenAI’s GPT-4 or Stability AI’s Stable Diffusion are trained on internet-scale datasets, which may include unlicensed data scraped from websites such as Wikipedia, Reddit, Stack Overflow, Instagram, DeviantArt, and others3. While such practices enhance the realism and utility of generated content, they raise legal and ethical concerns regarding whether the collection and use of such data are authorized4. Much of this scraped data may be copyrighted or may include personally identifiable information (PII), which is subject to privacy regulations such as the GDPR and CCPA5.

The materials of training the model fall into the following three types: • Public Domain Material: these can be texts and media whose copyrights have either passed out of copyright or have been licensed to be used freely6. • Licensed Data Sets: This is data that was created in a specific way, and is legally acquired through contracts or open licenses including Creative Commons7. • Unlicensed or Scraped Data: Data retrieved through Web-based crawlers which could have a copyright or privacy and collected without the knowing permission of the authors or the subjects8. One of the key issues in AI development is the lack of transparency in the documentation of training datasets. For example, OpenAI has been criticized for not disclosing the exact composition of the datasets used to train its GPT models, citing commercial interests.

Similarly, Meta's LLaMA series and the LAION-5B dataset developed by Stability AI have faced criticism for including copyrighted or personal images without clear user consent9. This lack of transparency hinders accountability and makes it difficult to assess potential violations of legal rights. Moreover, the use of personal data in training sets introduces significant privacy risks. Even if such data is later anonymized or transformed, generative AI models may reproduce or "hallucinate" real names, phone numbers, or addresses unintentionally. This directly impacts the right to informational privacy10. As AI systems become increasingly adopted in both commercial and governmental contexts, it is essential to scrutinize the nature and sources of training data.

Clearly defining the boundary between fairly and unfairly accessed data is fundamental not only to comply with intellectual property laws but also to protect the rights to privacy and dignity, which are essential in any democratic society11.

4. Copyright Concerns in AI Training

One of the most urgent legal issues in the current intellectual property landscape is the use of copyrighted material in training AI models. Legal copyright protection assures authors the exclusive rights to reproduce, adapt, and publish their works1. However, generative AI models such as GPT-4, Midjourney, and DALL·E require massive datasets to train, often including millions of books, articles, images, and code, frequently without the knowledge or authorization of the original copyright owners2. This practice raises critical legal questions: Is the use of copyrighted material for AI training illegal? Can developers claim immunity under doctrines like fair use or fair dealing? In India, the Copyright Act, 1957 provides authors a bundle of exclusive rights, such as the right to reproduce and the right to communicate works to the public3.

It also contains a fair dealing exception, allowing limited use of copyrighted works for purposes such as private use, criticism, review, and reporting of current events. However, the Act does not explicitly address the automated and large-scale ingestion of copyrighted content for commercial purposes, such as AI model development. This legislative ambiguity places AI developers at risk of infringement, particularly if their use fails to meet the threshold of being transformative or does not involve proper attribution4. In contrast, the United States adopts a broader fair use doctrine under Section 107 of the U. S. Copyright Act, which allows the use of copyrighted works without permission when used for purposes such as research, education, or commentary, provided it passes a four-factor test5: • The purpose and character of the use (e. g.

, whether it is transformative or commercial), • The nature of the copyrighted work, • The amount and substantiality of the portion used, and • The effect on the potential market for the original.

In Authors Guild v. Google, Inc. , the U. S. Court of Appeals held that Google’s digitization of books to create a searchable index qualified as fair use, emphasizing its transformative nature and minimal market harm6. However, whether the training of AI models constitutes a similarly transformative use remains unresolved and is likely to be tested in court. Recent lawsuits reflect the growing unease among copyright holders. Visual artists have alleged that AI models trained on copyrighted images without permission can produce derivative works that directly compete in the market7. Similarly, authors have argued that large language models like those developed by OpenAI are capable of reproducing copyrighted text verbatim, thereby infringing the right of reproduction8.

These legal actions signal an impending judicial reckoning, which may set precedents on whether AI training constitutes fair use or requires a licensing framework. Scholars and critics argue that unless AI training serves a socially beneficial or significantly transformative purpose, it may not satisfy the fair use test9. Furthermore, AI outputs often closely mimic the style of specific artists or reproduce substantial portions of existing texts, blurring the line between learning and copying. In such cases, AI-generated outputs may be classified as unauthorized derivative works, a clear infringement under both Indian and international copyright laws10. In India, this remains a legal grey area due to a lack of judicial interpretation or statutory guidance.

While the Indian Copyright Office has not yet issued formal directives on AI training, stakeholders are increasingly calling for regulatory clarity, particularly around attribution, compensation, and licensing. The challenge lies in striking a balance between fostering technological innovation and safeguarding the moral and economic rights of authors, especially as AI-generated content becomes nearly indistinguishable from that created by humans11.

5. Privacy Rights and Data Protection

Although, in the legal context, copyright issues are the primary focus of objections to AI training, individual privacy is another critical concern that must be addressed1. Since AI models are trained on large datasets that may contain personal user information, there is an ongoing concern about the unauthorized processing, collection, and potential disclosure of sensitive data2. These concerns strike at the core of informational privacy, i. e. , the right of individuals to control what happens to their personal data, with whom it is shared, and for what purpose3. In India, the right to privacy has been declared a fundamental right under Article 21 of the Constitution4. This encompasses the right to informational privacy, which protects individuals against the unregulated and unjust collection or surveillance of their data.

AI models often crawl the internet, including social media sites, blogs, forums, and other publicly accessible sources5. One of the central concerns is that personally identifiable information (PII), such as names, faces, locations, and even behavioural data, may be scraped and incorporated into training datasets6. This becomes especially problematic when, during inference, AI models produce outputs that unintentionally reveal confidential information about real individuals7. For example, chatbots or image generators may replicate personal characteristics or produce outputs that closely resemble a person's digital footprint8. These results not only infringe on privacy but may also lead to reputational harm, identity theft, or psychological distress9.

The recent enactment of the Digital Personal Data Protection Act, 2023 (DPDPA) in India marks an important step toward developing a comprehensive data protection regime10. The Act emphasizes principles such as purpose limitation, data minimization, and informed consent. Under this law, any organization that collects or processes personal data must obtain explicit consent from the data principal and use the data strictly for the stated purpose. These requirements are often at odds with the practices of many AI firms, which typically gather data by indiscriminately crawling websites, frequently without the awareness or consent of users11. At the international level, data protection compliance is more robust.

The General Data Protection Regulation (GDPR) of the European Union, for instance, establishes rights such as the right to be forgotten, the right to data portability, and mandates data protection impact assessments12. These rules require that AI developers, particularly those working with international datasets, have a lawful basis for processing personal data, especially when such data is used to train AI models. Despite these legal advancements, a significant regulatory gap remains concerning generative AI. In India, as in many other jurisdictions, there are currently no specific provisions governing the training of AI models using personal data13. This legal ambiguity creates uncertainty for developers regarding the permissible scope of data usage. The lack of dataset transparency and the absence of strong enforcement mechanisms further elevate the risk of mass privacy violations14.

Therefore, AI system design must not only comply with legal frameworks but also be guided by ethical considerations15. This includes conducting audits of training datasets, removing sensitive information, and implementing mechanisms to prevent or filter out personal data during model training21. As AI continues to evolve, ensuring that innovation does not come at the cost of individual dignity and autonomy will remain a critical challenge for lawmakers, technologists, and society at large.

6. Reconciling Fair Use and Privacy: A Legal Dilemma

The combined application of the doctrines of fair use (or fair dealing) and the right to privacy creates a complex and evolving legal conundrum in the context of artificial intelligence training models1. Both principles are intended to safeguard distinct yet equally vital public interests, fair use facilitates innovation, knowledge sharing, and creativity, while the right to privacy upholds individual autonomy, dignity, and control over personal data2. However, in the rapidly growing domain of generative AI, these doctrines are increasingly being juxtaposed and brought into tension3. This raises a pivotal question for scholars, developers, and lawmakers alike: Can the use of data for AI model training be considered fair and lawful if it encroaches upon the privacy rights of individuals whose data is involved?

4 Copyright law in many jurisdictions, including the United States, United Kingdom, and India, permits the fair use or fair dealing of copyrighted content5. This refers to the limited use of such material without the explicit consent of the copyright holder, typically for socially valuable purposes such as education, commentary, research, or criticism. In the context of AI, developers and technology firms frequently argue that the training of machine learning models on large volumes of data should be interpreted as a form of research or innovation and, as such, should fall within the protective ambit of fair use6. They contend that this exemption is essential for technological progress and for maximizing the capabilities of AI systems.

However, this argument tends to prioritize innovation over individual rights and often fails to account for informational privacy, a legal and ethical concept that emphasizes a person's right to govern the collection, use, and dissemination of their personal information7.

AI training datasets frequently contain not just publicly available data but also sensitive and personally identifiable information (PII), such as names, faces, addresses, conversations, preferences, and behavioral profiles8. In many cases, such data is scraped from the internet without the knowledge or consent of the individuals concerned9. AI systems generally rely on data scraping techniques, extracting content from a wide range of public web platforms, including social media, blogs, forums, and open databases. While developers often claim that public availability implies consent or legal permissibility, the reality is more nuanced10. The mere accessibility of information on the internet does not imply a waiver of privacy rights. Personal data that is publicly visible, whether intentionally shared or not, still carries with it legal protections under data privacy frameworks11.

Therefore, what may be considered permissible under the principles of copyright (e. g. , using text or images for machine training) may simultaneously constitute a breach of privacy when the data involved is personal in nature and obtained without consent12. This legal conflict becomes especially prominent in jurisdictions like India, where the right to privacy has been constitutionally enshrined as a fundamental right under Article 21 following the landmark decision of K. S. Puttaswamy v. Union of India in 201713. Indian data protection law, as embodied in the Digital Personal Data Protection Act, 2023 (DPDPA), places strong emphasis on consent, purpose limitation, data minimization, and the protection of personal data14.

Under this regulatory scheme, AI developers using datasets that include identifiable personal data, such as names, images, or location information, must obtain informed consent from the data principal. Even if the use of such data is deemed transformative or noncommercial, it may not pass legal muster if consent was not obtained, thereby rendering a fair use defense inadequate in such circumstances15.

At the same time, it must be acknowledged that existing privacy regulations, both in India and internationally, are not without gaps16. One significant limitation is that most legal frameworks focus predominantly on identifiable personal data, and tend to leave anonymized or aggregated data outside the scope of stringent regulation. AI developers often exploit this loophole by arguing that training data has been anonymized and thus no longer poses a risk to individual privacy. However, with advancements in re-identification techniques and inferential modeling, even anonymized datasets can be reverse-engineered to reveal sensitive patterns, identities, or behaviors17. This creates a grey zone in law, where datasets are technically anonymized but still capable of generating outputs that reflect, replicate, or approximate real individuals18.

Reconciling the twin doctrines of fair use and privacy thus requires a comprehensive legal and policy response, tailored specifically to the unique challenges of artificial intelligence19. First and foremost, there is a pressing need to redefine the contours of fair use and fair dealing in the digital and AI era20. Legislators should provide clearer guidance on whether and how largescale, automated data ingestion by AI systems can qualify as fair use. This would involve consideration of factors such as the nature of the data, the purpose of use, the presence or absence of consent, and the degree of transformation involved21. Secondly, privacy regulations must evolve to accommodate the risks posed by machine learning22. Laws must account for the possibilities of re-identification, inference-based profiling, and the generation of synthetic data that still mimics real human attributes23.

Provisions must be introduced to ensure transparency in data sourcing, allow for audits of training datasets, and impose strict penalties for non-consensual or unethical data use24. A duty to document datasets, outlining the nature, origin, and processing rationale, should be mandated, especially for models intended for public interaction or deployment at scale25.

Most critically, there is a need to develop a “consent-aware” model of fair use26. Under such a framework, the law would require not just an analysis of the purpose and extent of data use but also an evaluation of whether the use was accompanied by informed consent and meaningful privacy protections. This holistic approach would ensure that innovation proceeds within ethical and legal boundaries, and that AI technologies are developed in a way that respects both the creative commons and individual rights27. In conclusion, while fair use and privacy each serve indispensable roles in the legal ecosystem, their intersection in the context of AI training calls for a new paradigm, one that recognizes their overlaps and conflicts and seeks balance through legislative clarity, ethical design choices, and robust enforcement28.

Only then can we achieve a future where artificial intelligence is both innovative and responsible.

7. Proposed Legal and Policy Frameworks

With the growing legal tension between copyright protection, fair use, and privacy rights in the context of artificial intelligence, it has become evident that existing frameworks are illequipped to address the complexities of generative AI1. As AI systems increasingly rely on large-scale data ingestion, often without transparency or consent, there is an urgent need for legal and policy reforms that strike a balance between innovation and the rights of individuals and content creators2. One of the foremost issues is the opacity surrounding AI training datasets3. Many companies refuse to disclose whether their models are trained on copyrighted or personal data, operating in secrecy and avoiding accountability4.

A regulatory mandate requiring public disclosure of datasets, particularly when personal or protected content is involved, would enhance transparency and enable affected individuals to challenge unlawful usage. Such disclosure is essential for fostering accountability and ensuring compliance with both copyright and privacy standards5. Second, privacy legislation must evolve to address the realities of AI development6. Most data protection laws, including India’s Digital Personal Data Protection Act, 2023, focus on identifiable personal information within structured databases7. However, AI training typically involves vast volumes of unstructured data, and even anonymized datasets pose risks of reidentification.

Privacy frameworks must, therefore, incorporate explicit provisions governing AI training, including safeguards such as data minimization, purpose limitation, and mandatory anonymization processes. These principles are essential for protecting informational privacy in machine learning contexts.

Equally important is the development of a consent-based framework across both copyright and data protection regimes8. In the copyright domain, this could include mechanisms like collective licensing systems or opt-out registries where creators can deny the use of their work in AI training. For personal data, a robust informed consent mechanism must be embedded in AI development processes, reinforcing individuals’ rights to control their digital identity and personal information, even when such data is publicly available online9. The global nature of AI systems also demands international cooperation10. Institutions such as the World Intellectual Property Organization (WIPO), UNESCO, and the OECD have initiated discussions on ethical and legal frameworks for AI governance11.

Given its growing influence in the tech and legal sectors, India should take a leadership role in shaping international norms12. Harmonizing AI-related laws across jurisdictions is vital, especially considering that data flows and AI applications often cross national borders, creating enforcement and legal uncertainty. From a regulatory perspective, the establishment of independent AI oversight bodies or ethics boards is imperative13. These institutions should be empowered to audit training datasets, address complaints, and impose penalties for violations. They should also focus on raising awareness about the legal rights of individuals and creators whose data may be used in AI systems. Such regulatory bodies will be critical to ensuring both preventive and remedial measures in cases of infringement14. Finally, there is a need to promote research and civil society engagement.

Think tanks, academic institutions, and advocacy organizations must be encouraged to conduct impact assessments of generative AI systems, particularly with regard to privacy, intellectual property, and democratic values. These assessments can inform evidence-based policymaking and support the development of a rights-respecting AI ecosystem15.

8. Conclusion

The blistering pace of development in generative artificial intelligence has brought about transformative changes in the creation, processing, and consumption of information1. While these technological advancements hold significant potential for fostering innovation, efficiency, and creativity, they simultaneously pose complex legal and ethical challenges, particularly in the domains of copyright protection, fair use, and the right to privacy2. The current legal frameworks appear increasingly inadequate, as AI systems rely heavily on large volumes of data, much of which is collected without explicit permission or clear legal entitlement3. This paper explores the intersection between the legal doctrines of fair use and the right to privacy in the context of AI training, and how these two rights, though rooted in different objectives, can come into conflict4.

Copyright law aims to protect the economic and moral rights of content creators, ensuring control over the use of their intellectual property. Conversely, privacy law is designed to safeguard individuals from unauthorized access, use, or disclosure of their personal information5. The training of AI models on datasets that may contain both copyrighted and personal data reveals a significant legal grey area, where current laws provide neither clear guidelines nor effective remedies. This tension is particularly pronounced in India, where the right to privacy has been constitutionally recognized under Article 21, and where the recently enacted Digital Personal Data Protection Act, 2023, seeks to regulate data use at the national level6.

Nevertheless, neither India’s copyright framework nor its data protection regime offers a comprehensive solution tailored to the complexities introduced by generative AI7. This lack of clarity results in legal uncertainty for developers, confusion among users, and potential harm to individuals whose data may be unknowingly processed.

To address this regulatory gap, a harmonized legal framework is necessary, one that upholds the core principles of transparency, consent, accountability, and fairness. Legislatively, such reform should clarify the scope and limitations of fair dealing exceptions as they apply to AIgenerated content, establish explicit consent requirements for the use of personal data in training models, and provide accessible avenues for redress and enforcement. Beyond statutory reform, it is equally essential to promote ethical AI design, raise stakeholder awareness, and contribute to the formulation of international standards that can guide AI development across jurisdictions. The fundamental point is that the future of AI must not be built at the expense of basic human rights.

A hybrid, rights-sensitive regulatory approach is essential to ensure that generative AI evolves in a way that respects the creative contributions of authors while simultaneously protecting individual dignity and autonomy. Such a model is not only legally and ethically desirable but is also essential for building a sustainable and inclusive digital future.