Privacy enforcement and AI training data, 2025-2026: what matters for data suppliers

Who enforces privacy rules that touch AI training data?#

Privacy rules that touch AI training data are enforced by several bodies at once, each with different tools. For a US company licensing its records, the ones to watch are state privacy regulators, state attorneys general, the Federal Trade Commission and private plaintiffs.

These enforcers do not coordinate every case, but their concerns overlap. A practice criticized by one is a reasonable signal of what the others will ask about, so a supplier's review should read across all of them rather than track a single agency.

Recurring themes in recent public actions#

Recent public actions return to a small set of practices. None of them is specific to AI, which is the point: AI training data is judged by the same rules as any other use of personal information.

The final theme in the list below matters most for AI training, because licensing records for training is usually a new use of data collected for another purpose. A notice rewritten after the fact is a weak basis for that use, and regulators have said so publicly.

• 1Opt-out requests that were hard to submit, demanded unnecessary information, or ignored browser-based opt-out signals.
• 2Consent and cookie choices designed to steer people toward sharing.
• 3Contracts with recipients of personal information that lacked the terms the law requires.
• 4Sensitive information, such as health-related inferences or precise location, shared beyond what people expected.
• 5Companies operating as data brokers without registering where registration is required.
• 6Privacy policies changed, or applied retroactively, to permit new uses of data people had already provided.

Dated public signals to track, 2024-2026#

Several dated public signals from regulators and lawmakers bear directly on licensing records for AI training. The list is selective, not a complete record of enforcement actions, so check each regulator's announcements page for anything newer before relying on it.

Read the rows together. Promises made when data was collected follow the data, more states now give people rights over how their data is sold, and AI developers face their own documentation duties that they will pass back to suppliers.

What each theme means for a company licensing its records#

Each enforcement theme translates into a concrete check for a data supplier. Run these checks during the rights review, before any records are prepared, and keep the answers in the deal file.

Why the AI training angle draws attention#

AI training draws attention because it is a new use of data collected for something else, and because its effects are hard to reverse. Once personal information has shaped a model, removing it from the dataset may not undo its influence. Regulators have in some past cases required companies to delete models or algorithms built from improperly obtained data, a remedy that worries buyers as much as suppliers.

For a supplier, that moves the burden forward. Careful buyers ask for evidence that personal details were removed and that the supplier had the right to license what remains. A supplier that can show its notice history, de-identification method and contract terms stands on firmer ground than one that can only point to a clean-looking sample.

Operational records about how work gets done, such as job notes, order exceptions, engineering issues and support resolutions, can often be licensed with personal details removed. That is a different risk profile from selling consumer profiles, and the deal file should document the difference.

How to read an enforcement announcement#

An enforcement announcement is a starting point, not a summary of the law. Press releases compress the facts, and the complaint or order usually says far more about what the regulator found wrong and what the company must now do.

The required conduct is often the most useful part for a supplier. Terms that oblige a company to review every contract with recipients, rebuild its opt-out process or delete data collected without a proper basis show what a regulator considers the fix, and they make a practical checklist for your own licensing file.

• 1Read the complaint, order or settlement, not only the press release.
• 2Identify the statute relied on and the specific practice challenged.
• 3Note the non-monetary terms: audits, contract reviews, deletion duties and compliance reporting.
• 4Ask whether the same practice exists anywhere in your systems or vendor setup.
• 5Record the review in your privacy file with a date and an owner.

Illustrative: a staffing firm adjusts its licensing scope#

Illustrative: a fictional IT staffing firm is preparing to license records from its applicant tracking system and its internal recruiter playbooks. During the rights review, its general counsel reads a regulator's announcement about a company that mishandled opt-out requests and demanded too much information to process them.

She checks the firm's own process and finds that candidate opt-out requests arrived by email and were never linked to ATS profiles. Rather than reconstruct that history, the firm removes candidate profiles, resumes and interview notes from scope. It keeps client job requirements, placement timelines and recruiter process documents, with client and candidate names removed and a no re-identification clause in the draft license.

The firm also fixes its opt-out workflow going forward. The licensing project ends up smaller, but every record in it has a documented basis.

How SourceX reflects enforcement lessons#

SourceX applies these lessons early in the SourceX five-step transaction. During Rights, notice history, opt-out records and customer contracts are checked before a single record is prepared, and Preparation strips personal and confidential details as its starting position.

Each package's SourceX Evidence Packet then records the method used to remove identifiers, what was excluded and the promises the licensee makes, such as staying within permitted use and never attempting re-identification. Which laws govern a deal remains a call for the supplier's counsel.