Screen Recordings and Agent Trajectories: Rights in Third-Party Software and Data Captured on Screen

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

Why screen captures are the hardest provenance case

Screen recordings concentrate more third-party interests per record than almost any other training data type. A support ticket export typically comes from one system with one data controller; a 20-minute recording of an agent resolving that ticket may cross a CRM, a billing console, an internal wiki, a PDF from a customer, Slack, and a browser tab with a carrier's tracking page. Licensing practitioners already flag third-party items embedded inside licensed material as a chain-of-title risk [12], and a recording embeds them by construction.

Demand for this data is real because computer-use agents learn from it. Recent research trains agents from small sets of human-annotated trajectories and expands them with model-generated alternatives [1], so each human trajectory carries outsized weight. Modern capture tools also record more than pixels: agent-oriented recorders store narration, visited URLs, and console and network logs alongside video [3]. Every one of those channels can leak tokens, internal hostnames or customer identifiers.

For the data-type view, see turning screen recordings into action-labeled trajectories and what each trajectory step record must contain.

The four rights layers in a single frame

Every frame should be analyzed as four separate layers, because each has a different rights holder and a different fix.

The recording layer is usually the easiest, since the supplier operates the capture tooling. The display layers are where deals fail, because the supplier is often a licensee or a processor, not an owner.

Third-party software interfaces: what to check in vendor terms

A captured UI belongs to its software vendor, and the supplier's right to record and license it depends on the vendor's terms, not on the supplier's ownership of its own workflow. Whether a given interface is protected by copyright is a fact-specific question; the practical issue for buyers is contractual. Enterprise SaaS agreements and acceptable-use policies vary, and some restrict publishing screenshots, benchmarking, reverse engineering, or using the service to develop a competing product. Treat this as a hypothesis to verify per application, not a rule.

Ask the supplier to produce, for each application that appears in more than a trivial share of frames:

• the governing agreement (master subscription agreement, EULA, or open-source license) and its date;
• any clause on screenshots, confidentiality of the "service" or "documentation," benchmarking, and competitive development;
• whether the supplier is the customer of record or a user under someone else's tenant.

Prefer recordings in tools the supplier built and owns, and in synthetic or sandbox tenants seeded with test data. When the training goal is to mimic a specific commercial product, the analysis moves to the questions on replicating third-party software for agent environments. Where human capture is unnecessary, synthetic trajectory construction by environment exploration is a documented alternative [2]; record its generator and seed data as described in synthetic data provenance records.

Customer data visible on screen

Customer data in a recording carries the same obligations it carries in the underlying system, so the supplier needs the same authority it would need to export that system's records. If the supplier is a service provider operating inside its clients' tenants, the clients, not the supplier, typically control that data; see client data held by service providers and customer contracts and DPAs.

FTC technology staff have warned that using customer data for undisclosed purposes such as training can breach a company's own privacy commitments [4], and that quietly changing terms to permit AI use may be unfair or deceptive [5]. A recording does not launder that problem; it reproduces it in pixels, where field-level controls no longer apply. In the EU, whether masked frames count as anonymous is judged against all means reasonably likely to be used for re-identification [9], and screen context (ticket numbers, partial addresses, timestamps) makes that bar hard to meet.

Practical redaction, OCR-based detection and its failure modes are covered in PII redaction for screen recordings and agent trajectories. The rights point here is narrower: redaction reduces exposure, but it does not create a permission the supplier never had.

Colleagues, callers and biometrics in the frame

Incidental people in a recording raise employment, wiretap and biometric issues that are separate from the data in the software. Contact-center and sales recordings often include call audio; California's Penal Code 632 prohibits recording confidential communications without all parties' consent [6], so ask how call audio was captured and whether the caller notice covered secondary use. Webcam tiles and voice tracks can yield face geometry scans or voiceprints if processed for identification, and Illinois BIPA regulates those with its own release and retention duties [7].

For recorded employees, EU regulators treat workplace monitoring as requiring transparency and proportionality [8]. Ask for the recording notice staff actually received, and check it against the guidance on employee-authored records and consent and notice records. Pairing desktop video with transcripts, as in contact-center desktop activity datasets, compounds both layers.

Confidential documents and third-party IP on screen

Documents opened during a workflow may belong to outside parties and be covered by NDAs, even when the supplier lawfully holds them. A vendor quote, a partner's pricing sheet, or a client's draft contract shown in a PDF viewer is third-party confidential information; screen for it as described in third-party confidential information screening. Stock imagery, embedded videos and attachments follow the rules for third-party content inside licensed corpora.

Where a supplier says it acquired rights in recordings from contractors or a recording vendor, remember that a US transfer of copyright ownership requires a signed writing [11]. Ask for the agreement, not a summary, and log it in your chain of title.

Per-recording application manifest

A per-recording manifest is what makes exclusion possible after delivery, so require it as a delivery field rather than a nice-to-have. Without it, a later objection from one software vendor or one customer forces you to discard or re-review the entire corpus.

Illustrative example: invented to show structure; it does not describe an available dataset.

{
  "recording_id": "rec_000184",
  "capture_tool": "internal-recorder v3.2",
  "channels": ["video_1080p", "input_events", "url_log"],
  "audio_captured": false,
  "operator_notice_id": "notice_2026_03_staff",
  "applications": [
    {"app": "internal_order_console", "owner": "supplier", "frames_pct": 61, "rights_basis": "owned"},
    {"app": "third_party_crm", "owner": "vendor", "frames_pct": 27, "rights_basis": "vendor_terms_reviewed_2026-08", "tenant": "supplier"},
    {"app": "web_browser:carrier_tracking", "owner": "vendor", "frames_pct": 12, "rights_basis": "unreviewed", "action": "mask"}
  ],
  "customer_data_present": true,
  "customer_tenants": ["supplier_own"],
  "redaction": {"method": "ocr_field_mask+manual_qc", "qc_sample_pct": 5},
  "excluded_segments": [{"start_s": 412, "end_s": 455, "reason": "personal_email_open"}],
  "permitted_use_tags": ["agent_training", "internal_eval"]
}

Encode the permitted-use tags with a consistent vocabulary such as the one in the permitted-use metadata schema, and carry them into your training data use register.

Buyer checklist before licensing recordings

Run these checks before signature; most can be answered with documents the supplier should already hold.

1. Application inventory per recording, with frame share and rights basis for each app.
2. Governing terms for each third-party application above a set frame-share threshold, reviewed for screenshot, benchmarking and competitive-use restrictions.
3. Tenant ownership: confirm whether displayed data sits in the supplier's own tenant or a client's.
4. Customer contract and DPA review for any customer data shown, including the date terms changed [5].
5. Staff recording notice text and the date it was given.
6. Audio policy: captured or not; if captured, consent basis for every party [6].
7. Biometric screen for webcam and voice channels [7].
8. Redaction method, QC sample, and known residual risks for video, OCR text, URLs and network logs [3].
9. Confidential third-party documents screened and excluded.
10. Disclosure readiness: as of October 2026, a developer offering a generative AI system to Californians must post documentation that describes training datasets, including whether they contain personal information or copyrighted material [10].

Ask the supplier to sign a data rights attestation covering items 1-9, and keep the evidence for a later provenance audit.

How SourceX handles screen and workflow data requests

SourceX sources operational datasets from US companies on request, including new recordings of hands-on work, and manages licensing and ongoing purchases. Data is sourced on request, not held in stock, and a request does not guarantee a match. Every dataset is rights-reviewed for ownership and consents and delivered under a license defining records, uses, term and delivery; personal details such as names, emails, phones and account numbers are removed or replaced, the method is recorded, a sample is checked, and no method is perfect. Every release is approved by the supplying company, and SourceX does not source generic CCTV or photos. Buyers can describe the workflows they need on the SourceX buyers page, and compare scopes on screen recordings, workflow and screen activity data and training data for computer-use agents.

More provenance guidance lives in the provenance hub and the wider AI data guide.

Request rights-reviewed screen recording and trajectory data

Describe the applications, tasks and capture channels you need, not the businesses. SourceX looks for US businesses that hold that data, assesses data and licensing permissions, and nothing is contracted until a supplier agrees. Start your request at sourcex.si/buyers.