Training Data Provenance: Chain of Rights, Documentation and Attribution

Training data provenance is the record of where data used to train an AI model came from, who held the rights to it, under which license it was passed on and what was done to it before training. The record is often thin: the Data Provenance Initiative's audit of more than 1,800 text datasets, published 2023-10-25, found licenses omitted on hosting sites in more than 70 % of cases. Where provenance is detailed, it sits in private contracts and manifests, because the EU training summary shows licensed data only as Yes or No.

For the seller, provenance is what it must be able to show before a buyer pays; for the buyer, it is what it checks before training, and both sides meet it in every deal of AI training data licensing. Buyers such as micro1 tie a refund right to the accuracy of a written manifest, public datasets answer objections only in later versions, and attribution schemes promise payment by use without published rates. In general data management, provenance means the origin and history of any dataset; this page uses the training-data sense.

Every figure below names its source and the date it was checked, following the rules in how we source, date and check every figure.

What is training data provenance?

Training data provenance answers four questions about a dataset: where it came from, who held the rights, on what terms it moved and what was changed before training. Each question maps to a record that a seller keeps and a buyer can ask to see:

• Source and collector: the system, site or people the data came from, and who gathered it.
• Rights holder and license: who owned each item, and under which grant it passed to the next party.
• Consent and personal data: whether the people named in the data agreed, or another legal basis applies.
• Processing: de-identification, filtering, deduplication and labeling done before delivery.

Most of this detail stays private. The public summary that the EU AI Act requires of general-purpose model providers, on the Commission template C(2025) 8311, discloses licensed datasets only as Yes or No plus modality and never lists the licensors. Provenance for licensed data therefore lives in the order forms, manifests and warranties exchanged between the parties.

Public corpora are the opposite case. Their license notes, opt-out lists and takedown notices are open to anyone, and the same audit found license errors on hosting sites in more than half of the datasets it checked. A buyer that trains on a public corpus inherits whatever gaps those notes carry.

The provenance pages at a glance

The six pages below each take one part of provenance: the chain of rights, documentation, attribution, disclosure rules, removal and certification. The table lists them in the order of this page's title, as of 2026-11-10, with the key record each page rests on.

Who held which right: tracing licensed data from creator to model

A chain of rights runs from the person who created each item, through the company or platform that holds it, to the licensor who grants a license and, often through an intermediary, to the developer that trains the model. Each link is a separate legal step, and a gap at one link limits what every later party can grant:

1. Author or employee: creates the document, recording, code or image.
2. Company or platform: holds the item by employment, contract or terms of service.
3. Licensor: grants the license, often the same company.
4. Intermediary, if any: places the data with developers or licenses it on under the licensor's approved terms.
5. Developer and model: trains on the data within the scope of the grant.

A dataset license may cover less than the dataset. The Open Data Commons Attribution License (ODC-BY 1.0) governs, under section 2.4, only the rights over the database, not its individual contents. The Community Data License Agreement Permissive 2.0 (CDLA-Permissive-2.0, dated 2021-06-17) places no restriction in section 3.1 on results such as trained models. Creative Commons states that its licenses apply only where copyright permission is required, and that under a cautious reading content carrying a NoDerivatives (ND) term should not be used as training data (checked 2026-11-09).

LAION-5B shows the gap on the record. Its image-text pairs were released with metadata under CC BY 4.0, while the images themselves stayed under their own copyright. LAION took the dataset down on 2023-12-19 and released Re-LAION-5B on 2024-08-30 under Apache-2.0, with 5,526,641,167 text-link pairs by LAION's own count. The license on the list of links never reached the works behind them.

Checking each link of the chain inside a company's own records is the work of a rights audit of the data to be licensed, which covers copyright, database right, platform terms and the people named in the records. This page stays with how rights pass between parties along a dataset's history.

What buyers ask a seller to record about where data came from

Buyers and intermediaries publish what provenance records they expect, and the strictest tie payment to a written description of the data. The table sets out each program's stated record as of 2026-11-09, in alphabetical order, with a role column that keeps intermediaries apart from buyers.

micro1's terms, last updated 2026-11-08, show how far the record reaches. The Order Form carries a Data Manifest, the licensee has 30 business days to reject the data before it is deemed accepted, and a materially inaccurate manifest gives a clawback with refund that survives acceptance. Endless instead has the seller approve the manifest and define exclusions before anything moves, and Troveo packages anonymized data with a manifest and licenses it on the seller's behalf under terms the seller approves. Mercor's listing works from the other end: it names the provenance it will not take, such as data a foundry partner owns. What a manifest lists, and how it describes a dataset without handing it over, belongs to the data manifest; ownership warranties are compared on the rights audit page.

Provenance in public datasets: license notes, opt-out ledgers and takedown notices

Public training corpora carry provenance as license notes, opt-out lists and the takedown notices sent to their hosts, and each record shows how far a later objection reaches. License notes are the weakest layer: they were missing on hosting sites for most of the datasets in the audit cited above.

Takedown notices are the most visible layer. Torstar's cease-and-desist letter to Hugging Face over the FineWeb dataset, dated 2025-01-22, listed 361 domains in its Schedule A and asked for a response by 2025-01-31. Hugging Face publishes the notices it receives: its public folder held 29 notice files for 2025 and 30 for 2026 up to 2026-10-12, counted on 2026-11-09. Among them, The New York Times Company asked on 2026-05-19 for removal, by 2026-05-29, of the bloomberg/entsum dataset, which contains the NYT Annotated Corpus.

Opt-out records work forward, not backward. The Common Crawl Foundation published its full Opt-Out Ledger on 2025-09-17, and in a statement of 2025-11-04 it says that its WARC archive files are immutable and that affected URLs are removed or filtered from later crawls and public indexes. The Stack v2, a code dataset hosted on Hugging Face, removed in version 2.2.0 the opt-outs received before 2026-07-29. Which corpora sit behind current models, and under which licenses, is set out under major AI training datasets.

Provenance standards with a published specification

Five published specifications record provenance or training permissions in machine-readable form; none of them is law, and only some are standards in the formal sense. The table lists them by publication date, as of 2026-11-09, with the issuing body's own page as the source.

The five answer different questions. Datasheets for Datasets and the Data & Trust Alliance (D&TA) standards describe a dataset once it is assembled, which is what a buyer reads in a sale. TDMRep, the CAWG assertion and RSL declare permissions for a site or an asset before anyone collects it, which matters most to holders who publish openly. TDMRep is a W3C Community Group Final Report, never a W3C Recommendation. The D&TA's 2026 page footer reads "Data & Trusted AI Alliance", a different name from the one on the v1.0.0 standard.

Disclosure rules that make a data source public

Two disclosure rules in force require AI developers to publish what kinds of data they trained on, and neither names the licensor of a private dataset. Under Article 53(1)(d) of the EU AI Act (Regulation (EU) 2024/1689), applying from 2025-08-02, providers of general-purpose models publish a summary on template C(2025) 8311: licensed datasets appear as Yes or No plus modality (section 2.2.1), and datasets obtained through intermediaries are listed only if publicly known (section 2.2.2). The template sections and a published summary are read in detail under EU AI Act Article 53 training data summary.

California's AB 2013 (Cal. Civ. Code 3110-3111) took effect on 2026-01-01, according to an amicus brief filed in the Ninth Circuit, and requires a high-level summary of training datasets that includes whether data was purchased or licensed. X.AI LLC's challenge is on appeal from the denial of a preliminary injunction (9th Cir. No. 26-1591), as of 2026-11-09.

China's Interim Measures for Generative AI Services (CAC and six agencies, Order No. 15 (2023), in force 2023-08-15) address sourcing instead: training data must come from lawful sources, must not infringe IP and needs consent or another legal basis for personal information. Voluntary openness stays low, since the Foundation Model Transparency Index of December 2025 gives 13 companies a mean score of 41 of 100, down 17 points.

Paying holders by use: attribution claims and court records

Attribution in training data means tracing a model output back to the data that shaped it, and a few companies now offer to pay holders by that measure. Bria states that works exceeding relevance thresholds earn ongoing compensation, that compensation ties to influence rather than catalog size, and that each asset carries an identifier linking it to source, creator and license terms (checked 2026-11-09). Bria publishes no rate or percentage.

RSL Collective offers two collective licenses that a publisher adopts with a License line in its robots.txt file. The paid AI training license promises royalties whenever an AI application uses the content to generate a result, with rates not published; the attribution license allows training in exchange for attribution links instead of payment (checked 2026-11-09). ProRata states that publisher content supplied for attribution is never used for model training, which places its model in AI answers rather than training. Revenue share and per-use payment as deal structures are compared under how AI data buyers pay.

The court record limits attribution claims under copyright management law. In Doe 1 et al. v. GitHub, Inc. (N.D. Cal. 4:22-cv-06823-JST; 9th Cir. No. 24-7700), the Ninth Circuit on 2026-09-16 affirmed dismissal of the DMCA section 1202(b) claim over Copilot and Codex reproducing code without attribution, holding that the tools create new works that never contained copyright management information. The mandate issued on 2026-10-08, and the case is back in the district court as of 2026-11-09.

Benefits, risks, downsides and alternatives of documenting provenance for a sale, including not licensing

Documenting provenance costs time before any money arrives, but it decides which buyers will accept the data and what the seller can be made to refund.

Benefits

• Admission to buyers that require records: Defined.ai asks for data sourced with consent, documentation and the right to commercialize, and Datarade prohibits illegally scraped data.
• A defense against clawbacks: under micro1's terms, an accurate manifest leaves no ground for the refund right that survives acceptance.
• A cleaner public record where the developer must publish an AI Act training summary.

Risks

• A manifest that overstates rights creates refund duties that outlive acceptance.
• Records that reveal pirated or unlicensed sources expose the user: Bartz v. Anthropic (N.D. Cal. 3:24-cv-05417) ended in a USD 1.5 billion non-reversionary settlement, with final approval and judgment on 2026-07-20 (Dkt. 680).
• Audits reopen the records: Defined.ai's Supplier Program allows one audit a year on 15 business days' notice.

How courts and legislatures treat training on works with and without a license is set out under copyright and AI training across jurisdictions.

Downsides

• Staff time to trace each source back through every link of the chain.
• The trace can show that part of the data cannot be licensed at all.

Alternatives

• License only the subset whose rights are fully traced.
• Publish under an open license, such as ODC-BY or CDLA-Permissive-2.0, knowing what each one covers.
• Join a collective, opt-in route such as RSL Collective.
• Do not license at all, and record an opt-out where the collector keeps a register, as Common Crawl does.

Not licensing keeps every record private and forgoes any fee. The full range is weighed under alternatives to selling data to AI labs, including not selling at all.

Where provenance meets the seller process, the law and the source routes

Provenance is recorded at every step of a sale and read by every law that asks where data came from; the pages below take those steps and rules one at a time.

• How AI companies get training data, route by route.
• AI crawlers and the opt-out signals they read.
• AB 2013 training data transparency in California and the appeal against it.
• AI copyright lawsuits over training data, including Doe v. GitHub and Kneschke v. LAION.
• AI data licensing agreements: warranties and manifests, clause by clause.
• Who buys AI training data and what each buyer asks for.
• Due diligence in an AI data deal: what buyers check before signing.
• AI training data glossary: provenance, chain of rights and related terms.

Frequently asked questions

What is the difference between data provenance and data lineage?

Provenance records where data came from, who held the rights and what happened to it; lineage records how data moved and changed through systems and pipelines. For licensed training data, the license, consent and chain-of-rights records belong to provenance. Lineage matters inside a buyer's pipeline after delivery, where it tracks filtering and transformation steps.

Is provenance the same as origin?

No: origin is one field of provenance, while provenance adds the rights and the processing history. Knowing that a dataset came from a support desk says nothing about whether customers' messages may be licensed, or whether names were removed before delivery. A buyer checks all three before training.

What is the difference between metadata and provenance?

Provenance is a kind of metadata: the part that records source, rights and history. The D&TA Data Provenance Standards make the split explicit by grouping their fields into Source, Provenance and Use. Other metadata, such as file format or size, describes the data without saying where it came from or who may license it.

Can content be removed from a training dataset after release?

Removal reaches later versions of a dataset, not copies already made. Common Crawl states that its WARC files are immutable and that affected URLs are filtered from later crawls, and The Stack v2.2.0 removed opt-outs received before its cutoff. Takedown notices to a host, such as those Hugging Face publishes, work the same way.

Is there a certification for models trained only on licensed data?

Private labels exist, issued by organizations rather than by a regulator. Fairly Trained and Credtent offer certification or licensing labels for AI companies and content catalogs. DataPacts certifies nothing and recommends no label. What each label checks is the subject of the certification page listed in the table above.