Skip to content

Data licensing for AI training

Buying data outright vs licensing it: dataset assignment for AI teams

Quick answer

Buying a dataset outright means taking an assignment of whatever rights the seller holds, but for most operational data those rights are thin: facts carry no copyright, personal data carries obligations that travel with it, and sellers almost always keep an operating copy. For AI training, an exclusive, perpetual, irrevocable license with clear model-retention terms usually delivers the practical benefits of ownership at lower cost. Pursue a true assignment only for commissioned or newly created data.

By SourceX Editorial · Updated

  1. 01Your data spec
  2. 02Matched to businesses
  3. 03Rights and samples reviewed
  4. 04Licensed delivery
How it works with SourceX: Your data spec → Matched to businesses → Rights and samples reviewed → Licensed delivery.Illustrative

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

What "ownership" of a dataset actually transfers

An assignment transfers only the legal rights the seller has, so the first question is what rights exist in the data at all. In the US, a copyright assignment must be in a writing signed by the owner or its authorized agent [1], which is easy to satisfy. The harder problem is that the Supreme Court held in Feist that facts are not copyrightable and that a compilation is protected only in its original selection, coordination or arrangement, not in the effort spent collecting it [2].

For a buyer, that means "full rights" to a table of support tickets, invoices or sensor readings may amount to copyright in some free-text fields, a thin compilation right in the schema, and contract rights. Trade-secret status is the other asset, and it is only preserved while the data stays confidential. The US has no general sui generis database right, so the contract and confidentiality obligations do most of the work whether you call the deal a purchase or a license.

Practically, ownership buys you three things a license may not: the right to sue third parties over the data, freedom from termination, and the right to resell or sublicense. Check whether you actually need each one before paying for it.

Why sellers keep operating copies and residual rights

Sellers of operational data rarely can or will hand over the only copy, because the data is a byproduct of running their business. A CRM export, a ticketing history in Zendesk or Salesforce Service Cloud, or an ERP ledger keeps living in the seller's systems after closing, and the seller needs it for its own operations, audits, litigation holds and record-retention duties.

Expect a seller asked to assign to carve out at least:

  • Operational use: continued use of the underlying records in its own business.
  • Retention for compliance: copies held for tax, regulatory or litigation purposes.
  • Derived data: aggregates, analytics and models it has already built; practitioners advise licensors to define derivative-data rights precisely to keep control and value [7].
  • Future data: records created after the cut-off date, which an assignment of a snapshot does not reach.

If those carve-outs exist, "ownership" is effectively a non-exclusive right plus a covenant not to sell to others. That is a license with a different label, and you should negotiate it as one. See the AI data license negotiation checklist for fallback positions.

Personal data cannot simply be sold free and clear

Rights in personal data do not pass as clean property, because privacy obligations attach to the information and follow it to the buyer. Under the Gramm-Leach-Bliley privacy rule, a business that receives nonpublic personal information from a financial institution steps into that institution's shoes and is bound by the same reuse and redisclosure limits [5]. Health data is constrained differently: for AI training, the usual routes out of a covered entity are de-identification under 45 CFR 164.514 (Safe Harbor or Expert Determination) or, for research, public health or health care operations, a limited data set under a data use agreement that binds the recipient [4].

California's definition of "deidentified" information also places ongoing conditions on whoever holds the data, including contractually binding downstream recipients [3]. An outright purchase therefore does not remove your obligations; it can add them, because you become the controller or business for that data. If EU or UK residents appear in a US-sourced set, transfer mechanisms apply as well; see buying US-sourced data that contains EU or UK personal data.

The practical consequence: whatever you call the deal, the dataset should arrive de-identified, with the method documented, and the agreement should state who bears re-identification and consent risk.

When a true assignment is worth pursuing

A real assignment makes sense when the seller created the data for you or can genuinely part with it. The strongest cases are:

  1. Commissioned collection: new recordings, annotations or expert-written examples produced under your contract, where you can require assignment from the outset. See commissioned datasets: IP assignment vs license.
  2. Discontinued product lines: a seller exiting a business with no further operational need for the records.
  3. Asset acquisitions: data acquired alongside a product, team or company, where change-of-control terms decide what moves; see assignment and change of control in AI data licenses.
  4. Contractor-created content: where a chain of assignments from individual creators is verifiable; see verifying IP assignment for contractor-created data.

Outside these, insisting on ownership tends to shrink the pool of willing sellers and raise the price without changing what your training pipeline can do. If you are scoping such a request, the SourceX buyers page is where you describe the data and the rights you need.

The exclusive perpetual license as the practical alternative

For most AI teams, the rights that matter are the right to train, to keep trained weights, and to stop competitors from getting the same data. An exclusive, perpetual, irrevocable license can deliver all three without an assignment.

Market platforms show the default is licensing, not sale: AWS Data Exchange products are offered under a Data Subscription Agreement by default, with providers setting usage rights per offer [6]. Moving from that default to ownership is a large ask; moving to a broader license is a normal negotiation.

Illustrative example: invented to show structure; it does not describe an available dataset.

NeedOutright assignmentExclusive perpetual licenseNon-exclusive term license
Train and fine-tune on the dataYesYes, if the grant covers trainingYes, within term
Keep model weights after the deal endsYesYes, if survival is written inOnly with a survival clause
Block competitors from the same dataYes, subject to seller carve-outsYes, within the defined fieldNo
Resell or sublicense the raw dataYesOnly if grantedRarely
Sue third parties for misuseYes, as ownerDepends on the grant and the right involvedNo
Seller keeps operating copyUsually, via carve-outYesYes
Relative costHighestHighLowest
Seller willingnessLow for operational dataModerateHigh

The license column only matches ownership if the drafting is right. Model retention is the clause that most often fails; read what happens to trained models when a data license ends before signing anything with a term.

Price trade-offs between owning and licensing

Ownership costs more because the seller gives up future revenue from the same records and accepts limits on its own use. Exclusivity has the same effect at smaller scale: the seller prices in every other buyer it can no longer serve within your field.

Three levers usually narrow the gap:

  • Field-of-use exclusivity: exclusive for, say, LLM training in a named vertical, non-exclusive elsewhere.
  • Time-boxed exclusivity: exclusive for a period, perpetual non-exclusive afterward, with weights retained.
  • Structure: flat fee for the snapshot plus per-record pricing for refreshes; compare options in AI data license pricing structures.

Before negotiating, size what the data is worth to your model with an ablation or a held-out evaluation; estimating a dataset's value before you buy covers the method. Paying an ownership premium for data that moves your metrics marginally is the most common overpayment.

Clauses to request in either structure

The same core terms protect you whether the document is titled a purchase agreement or a license. Use this as a checklist.

Illustrative example: invented to show structure; it does not describe an available dataset.

  • Grant or conveyance: "assigns all right, title and interest" or "grants an exclusive, perpetual, irrevocable, worldwide license to use, reproduce and modify for training, evaluating and improving machine-learning models."
  • Scope definition: record types, fields, date range, file formats (Parquet, JSONL, CSV) and row counts by delivery.
  • Retained rights: an exhaustive list of seller carve-outs, so anything unlisted passes to you.
  • Model and output rights: weights, checkpoints, synthetic data and outputs survive any termination.
  • Exclusivity covenant: the field, territory and period in which the seller will not license the same or substantially similar data.
  • Privacy representations: de-identification method, the statute it targets (HIPAA, GLBA, CCPA) and who carries consent risk.
  • Warranties and indemnity: title, non-infringement and lawful collection; see data warranties to require.
  • Documentation: source, collection dates and rights basis, which also feed downstream duties such as the EU AI Act training-content summary for general-purpose model providers [8].

How to scope an ownership or exclusive-rights request

Start by describing the data and the rights you need, including whether you need exclusivity, model retention or resale, rather than asking for "ownership" in the abstract. SourceX sources operational datasets from US companies on request, rights-reviews each one for ownership and consents, and delivers it under a license that defines the records, uses, term and delivery. Nothing is contracted until the supplying company agrees, and a request does not guarantee a match. Describe the dataset and rights you need on the SourceX buyers page.

For the seller-side view of the same question, see data licensing vs data selling and should companies sell or license data. The broader guide to AI training data licensing and the AI data hub cover related terms.

Frequently asked questions

Does buying a dataset outright let us ignore the original privacy notices?

No. GLBA reuse and redisclosure limits follow nonpublic personal information to the recipient [5], and HIPAA data reaches a non-covered buyer only through routes such as de-identification or a limited data set under a data use agreement [4]. De-identification before transfer is the usual way to reduce that exposure.

Can a seller assign a dataset it scraped from the web?

It can only assign rights it holds, and scraped content usually belongs to third parties. An assignment of such data gives you little title and significant risk; ask for the rights basis of every source.

Is a "data purchase agreement" different from a license?

The label matters less than the operative clauses. Many documents titled purchase agreements contain seller carve-outs that make them non-exclusive licenses in practice. Read the grant and retained-rights sections first.

Sources

  1. Cornell Law School Legal Information Institute, "17 U.S. Code § 204 - Execution of transfers of copyright ownership". https://law.cornell.edu/uscode/text/17/204
  2. Cornell Law School Legal Information Institute, "Feist Publications, Inc. v. Rural Telephone Service Co., 499 U.S. 340" (1991). https://www.law.cornell.edu/supremecourt/text/499/340
  3. California Legislative Information, "California Civil Code section 1798.140 (California Consumer Privacy Act definitions)". https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140
  4. Electronic Code of Federal Regulations (eCFR), "45 CFR 164.514 - Other requirements relating to uses and disclosures of protected health information". https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514
  5. Federal Trade Commission, "How To Comply with the Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act". https://www.ftc.gov/business-guidance/resources/how-comply-privacy-consumer-financial-information-rule-gramm-leach-bliley-act
  6. Amazon Web Services, "Creating an offer for AWS Data Exchange products". https://docs.aws.amazon.com/data-exchange/latest/userguide/prepare-offers.html
  7. Norton Rose Fulbright, Data Protection Report, "Where data meets IP: protecting business data in a commercial context" (2021). https://www.dataprotectionreport.com/2021/10/where-data-meets-ip-protecting-business-data-in-a-commercial-context/
  8. European Commission, AI Act Service Desk, "AI Act Article 53: Obligations for providers of general-purpose AI models". https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-53

Tell us what your models need

Share scope, volume, language, format, timing and licensing requirements.

Request data