Guide
Consent Requirements for AI Training Data
Short answer
AI training data consent requires a documented chain proving every participant granted the rights the buyer needs, before capture. That means a written release, a recorded legal basis, on-site permission where relevant, and an artefact trail linking each delivered episode back to its release. Consent is separate from the data license: consent covers the people in the footage, the license covers what a buyer can do with it.
Last reviewed:
What does consent for AI training data actually need to cover?
A consent chain is the documented trail proving that every person appearing in a dataset granted the rights the buyer needs, before capture. It links each delivered episode to a signed release and records the legal basis, so the license a buyer receives is backed by artefacts rather than an assurance. That distinction matters because training data with murky consent is a legal and reputational liability that tends to surface only after a model has already shipped.
This is general information about how consent is typically documented for commercial training data, not legal advice. Confirm the specific requirements for your jurisdiction and use case with counsel.
How is consent different from a data license?
Consent and license answer two different questions. Consent establishes that the people appearing in the footage agreed to be recorded and to how the footage would be used — it is about the participants. A license is the separate grant defining what the buyer of the resulting dataset can legally do with it — train commercially, redistribute, sublicense, and so on. A dataset can have a permissive commercial license and still carry an undocumented consent problem underneath it, which is exactly the risk a documented consent chain is built to close.
What does a documented consent chain look like end to end?
| Stage | What is documented |
|---|---|
| Before capture | Written release signed, identity verified, terms of use agreed |
| At capture | Site permission on file; bystander signage posted where the site is semi-public |
| At ingest | Automated face, plate and screen detection; speech scrubbed of identifiers |
| At review | Human reviewer confirms no un-consented person is identifiable in any frame |
| At delivery | Consent artefact IDs listed per episode in the batch data card |
| After delivery | Withdrawal requests honoured for undelivered footage; delivered footage cannot be recalled, and that limit is stated in the release itself |
Firsthand’s own consent chain, stage by stage. See /provenance for the underlying release language and de-identification pipeline.
Why does this matter for a commercial training pipeline?
A model trained on footage with an undocumented or thin consent trail carries a liability that is invisible during evaluation and expensive to discover after deployment — there is no way to retroactively prove a participant agreed to commercial use once the model is already shipping. A verifiable, artefact-backed consent chain is what lets a commercial team actually ship a model trained on human demonstration data with that question already settled.
Every Firsthand contributor signs a written release granting commercial training rights before capture, and each batch ships with the consent artefacts and a data card listing jurisdictions of capture. See /provenance for the details.
Related
- Consent chain
- Provenance & licensing
- Dataset provenance explained
- Research-only vs commercial dataset licenses
- How to license training data for commercial models
- AI training data rights checklist
- Public dataset licenses, compared
- PII in robotics data
- Consent and privacy for robot pretraining data at scale
- What is responsible egocentric data collection
FAQ
Consent Requirements for AI Training Data, answered.
01What is the minimum a consent chain needs to document?
At minimum: a written release signed before capture, the legal basis recorded, site permission where relevant, and a way to link each delivered episode back to its release. Without that link, consent cannot be verified per file after delivery.
02Is consent the same thing as a data license?
No. Consent covers whether the people appearing in the footage agreed to be recorded and how it would be used. A license is the separate grant defining what a buyer can legally do with the resulting dataset. A dataset can have a commercial license and still have an undocumented consent problem underneath it.
03Can a withdrawal request remove footage that has already been delivered?
On Firsthand, withdrawal requests are honoured for undelivered footage, but delivered footage cannot be recalled — and that limit is stated in the release itself, rather than discovered later.
04Does de-identification remove the need for consent?
No. De-identification (face, plate, screen and speech scrubbing) reduces the risk that an un-consented bystander is identifiable, but it does not substitute for a documented release from the actual participants performing the recorded activity.
05How does this relate to a dataset’s commercial license?
They are two separate but related checks. Consent asks whether the people in the footage agreed to it; license asks what a buyer can do with the footage once consent is established. See research-only vs commercial dataset licenses for the license side of this question.
Check it against the sample pack.
40 episodes across 4 environments, delivered in the exact schema these guides describe.