AI Training Data Rights Checklist

Before a commercial model team commits a training roadmap to any dataset — public or custom, egocentric or otherwise — the license attached to that data has to be checked independently of its size, label quality, or reputation. A corpus can be large, well-labeled, and exactly the right shape for a training mixture, and still be unusable for a shipping product if its license was never written to permit commercial training. Scale and label quality answer "is this data good?" A separate question — "can I actually train a commercial model on this data?" — has to be answered on its own, because the two do not move together.

This checklist collects the rights questions a team should be able to answer, with evidence, before training begins: commercial-use permission, documented consent, provenance, anonymization, ownership terms, and what the license actually specifies about derivatives, redistribution and exclusivity. Each item below links to a fuller explanation elsewhere on this site. Treat the checklist as a reusable gate to run against any dataset under consideration, not a one-time check tied to a single source.

This page explains what to check and why it matters. It is general information, not legal advice — have counsel review the specific contract before relying on it.

A commercial license is only as defensible as the consent behind it. For data recorded from real people — demonstrations, teleoperation sessions, or any first-person capture — the question is not whether a license exists, but whether each unit of data in that license traces back to a documented, per-contributor agreement. A dataset-level statement that "participants consented" is not the same thing as a consent chain: a chain means each episode or clip links to a specific, signed consent artefact, not a blanket assumption applied after the fact.

A data card is where that documentation should surface for a buyer evaluating a dataset. A properly maintained data card records the consent basis for the batch and the jurisdictions where capture took place, so the consent chain can be verified rather than taken on faith. Ask the provider directly for this record; a provider that cannot produce it, or that treats consent as implicit, is passing along exposure the buyer will carry after training.

• A signed release exists for every contributor, captured before recording
• Each episode or clip links to a specific consent artefact, not a dataset-level blanket statement
• A data card records the consent basis and the jurisdictions where capture took place
• The release explicitly covers commercial training use, not research use only

Provenance is the record of where data came from, how it was captured, and what happened to it between capture and delivery — and it is the backbone that makes a consent chain and a license grant verifiable rather than asserted. A dataset with strong provenance can answer, per batch: who captured it, under what consent, in which jurisdiction, and what review or de-identification steps it passed through before delivery. A dataset without that record forces a buyer to accept the license terms without being able to check them against anything.

In practice, provenance shows up as a data card attached to each delivered batch, listing consent artefact IDs per episode, the jurisdictions of capture, and the license terms that apply. Checking provenance means asking for that record directly, not inferring it from a dataset’s publication venue or how it is described in a paper.

Anonymization and consent are related but separate checks. A contributor’s own consent covers their own appearance and performance in the data; it does not automatically cover bystanders who happen to be in frame but never signed a release. That is why de-identifying bystanders irreversibly at the pixel level — faces, license plates, screens, and similar identifiers — is part of what makes a commercial license defensible: it removes the category of person whose consent was never obtained from the data a buyer is licensing, rather than leaving that exposure in and hoping it is never challenged.

Anonymization does not replace a documented consent chain for the contributor themselves — the two checks answer different questions. Bystander de-identification addresses people who did not consent at all; the consent chain addresses whether the person whose performance is the actual training signal agreed to the specific commercial use the license grants. A rights review should confirm both independently.

A license that only says "commercial use permitted" leaves several practical questions unanswered. A well-specified training data license should state, in plain terms, whether the grant covers: training the model itself; derivative works such as labeled subsets, augmented or retargeted versions of the raw data; and the resulting model weights — not just the raw data as delivered. Many public research corpora stop at a research-only or non-commercial grant precisely because they were released by academic labs whose goal was reproducible science, not clearing a path for commercial model training.

Not every public corpus is research-only, though, and terms have to be checked per dataset rather than assumed. Egocentric-10K, for example, is released under an Apache 2.0 license according to its official Hugging Face dataset page — a permissive, commercial-compatible license that is the exception rather than the rule among large public egocentric corpora. The only reliable way to know where any specific dataset falls is to read its current license text directly.

"Buyer-owned" describes a commercial license that is perpetual and irrevocable, rather than a revocable subscription the provider can later pull back, or a research-only grant that never covered commercial training in the first place. It does not necessarily mean the underlying data’s copyright is assigned or transferred to the buyer — that is a distinct legal concept. What buyer-owned does mean is that the commercial rights a team actually needs — to train on the data and to use the resulting model commercially — cannot later expire, be revoked, or be renegotiated by the provider.

Non-exclusive is the default for most commercially licensed training data: the same data can be licensed to more than one buyer unless exclusivity is specifically negotiated into the agreement. Exclusivity, when requested, is an added term on top of the base commercial license — it is what guarantees the specific data a buyer is paying for will not also be resold to another buyer, including a competitor. For a custom collection built against a buyer’s own specification, exclusivity is available as an explicit option rather than assumed.

Redistribution is a separate clause from commercial use, and a license that permits training a model does not automatically permit sharing the underlying data with a partner, contractor, or downstream customer. A buyer that plans to share raw data with an outside annotation vendor, a co-development partner, or a customer needs that right written into the license explicitly, since it is commonly withheld even where commercial training use is granted. Models derived from the data are typically treated differently from the raw data itself — a license can permit unlimited use and distribution of a model trained on the data while restricting redistribution of the raw footage.

This distinction matters most for teams that plan to involve a third party anywhere in their pipeline. Confirm, specifically: can the raw data be shared with a named third party for labeling or processing; can derived models be distributed without restriction; and does either right survive if the underlying license is later renegotiated.

A custom, on-demand collection answers most of the checklist above by design rather than by negotiation after delivery. Because the buyer commissions the collection against its own specification, the license terms — commercial use, perpetual and buyer-owned rights, and optional exclusivity — are set before a single episode is captured, and the documented consent chain is built into the collection process itself: every contributor signs a release covering the intended commercial use before recording, and each resulting episode links to that consent artefact through delivery.

That is the structural advantage custom collection has over adopting a public corpus after the fact: with a public dataset, a buyer is checking whether an already-published license happens to cover its intended use, after the data already exists. With a custom collection built on a written spec, the license is written to cover the intended use from the start, and a data card documents the consent basis, jurisdictions of capture and license terms for the batch as it is delivered, rather than being reconstructed after a question arises.

Before committing a training roadmap to any data source, a buyer should be able to get a direct, specific answer to each item below — and a provider that cannot answer one of them plainly is itself useful information.

This checklist describes what to ask and verify. It is general information, not legal advice — have counsel review the specific agreement before relying on it.