TAI BUI
Back to curriculum
LearnPython

Data Provenance and Training-Data Governance

EU AI Act requires machine-readable opt-out standards for GPAI by August 2025 (via the EU Copyright Directive TDM exception). California AB 2013 (signed 2024), the Generative AI training-data transparency law, requires developers to publish a summary of their training datasets with 12 mandated fields. 2025 DPA alignment on legitimate interest: Irish DPC (21 May 2025) accepts Meta's LLM training on first-party public EU/EEA adult content with safeguards after the EDPB opinion; Cologne Higher Regional Court (23 May 2025) dismisses the injunction; Hamburg DPA drops its urgency procedure; UK ICO (23 September 2025) issues a positive regulatory response to LinkedIn's AI-training safeguards (transparency, simplified opt-out, extended objection windows) and keeps monitoring, which is not a formal clearance. Brazilian ANPD (2 July 2024) suspended Meta's processing over insufficient information transparency, and lifted the preventive measure on 30 August 2024 after Meta submitted a compliance plan. The irreversibility problem: cookie-consent frameworks are built for real-time, reversible tracking, but once data is in model weights there is no practical surgical erasure, and so no practical GDPR right-to-erasure for trained neural networks. The compliance window is collection time. Data Provenance Initiative (dataprovenance.org; Longpre, Mahari, Lee et al., "Consent in Crisis", July 2024): a large-scale audit shows the AI data commons shrinking quickly as publishers add robots.txt restrictions.

TIME: ~60 minutesPREREQUISITES: Phase 18 · 24 (regulatory), Phase 18 · 26 (cards)

Learning Objectives

  • Describe California AB 2013's 12 mandated fields for Generative AI training-data transparency.
  • State the 2025 DPA position on legitimate-interest LLM training (Irish DPC, UK ICO, Hamburg, Cologne).
  • Describe the irreversibility problem: why GDPR right-to-erasure has no practical equivalent for trained neural networks.
  • State the Data Provenance Initiative's "Consent in Crisis" finding.

The Problem

Training-data governance sits upstream of every model card (Lesson 26) and every regulatory obligation (Lesson 24). Between 2024 and 2025 the rules settled around three principles: opt-out infrastructure, per-dataset disclosure, and legitimate-interest accommodations for publicly available data. A provider that misses the compliance window at collection time cannot remediate downstream.

Warm-up0/3
1. Which artifact documents a trained model's intended use, evaluation results, and known limitations for downstream users?Warm-up
A document released with a trained model showing three illustrative fields, intended use, evaluation results and known limitations, with a blank chip asking what this document is called.
2. A website owner wants to tell well-behaved web crawlers which pages not to fetch. Which long-standing convention does this?Warm-up
A website with one page it wants skipped next to a well-behaved crawler that checks before fetching, with a blank chip asking the long-standing convention for this.
3. A company must remove one customer's row from a database table. How does it normally do that?Warm-up
A four-row customer table with row 3 highlighted next to a request to remove only that row, with a blank chip asking how this is normally done.

The Concept

California AB 2013

Signed 2024. Documentation must be posted on or before January 1, 2026 for systems released on or after January 1, 2022. Section 3111(a) requires developers to publish a high-level summary of datasets used in training with 12 statutory items:

  1. Sources or owners of the datasets.
  2. Description of how the datasets further the intended purpose of the AI system.
  3. Number of data points in the datasets (general ranges acceptable; estimates for dynamic datasets).
  4. Description of the types of data points (label types for labeled datasets; general characteristics for unlabeled).
  5. Whether the datasets include any data protected by copyright, trademark, or patent, or are entirely in the public domain.
  6. Whether the datasets were purchased or licensed.
  7. Whether the datasets include personal information (per Cal. Civ. Code §1798.140(v)).
  8. Whether the datasets include aggregate consumer information (per Cal. Civ. Code §1798.140(b)).
  9. Cleaning, processing, or other modification by the developer, with intended purpose.
  10. Time period during which the data was collected, with notice if collection is ongoing.
  11. Dates the datasets were first used during development.
  12. Whether the system uses or continuously uses synthetic data generation.

Item 12 (synthetic data) is new relative to the Gebru et al. 2018 datasheets. Item 7 (personal information) brings in California Privacy Rights Act (CPRA) obligations. The statute exempts security/integrity systems, aircraft operation, and federal-only national-security systems (Section 3111(b)).

EU AI Act (Lesson 24) and TDM opt-out

The EU Copyright Directive's text-and-data-mining exception allows training on publicly available content unless the rightholder opts out. The Copyright chapter of the EU AI Act GPAI Code of Practice requires GPAI providers to respect machine-readable opt-out signals such as robots.txt or the C2PA "No AI Training" claim.

2025 DPA convergence on legitimate interest

The Irish DPC (21 May 2025) accepted Meta's plan to train on first-party public EU/EEA adult-user content, with safeguards, after the EDPB opinion. The Cologne Higher Regional Court (23 May 2025) dismissed the injunction against Meta on the grounds that opt-out is sufficient. The Hamburg DPA dropped its urgency procedure for EU-wide consistency. The UK ICO (23 September 2025) issued a positive regulatory response to LinkedIn's resumption of AI training, which had similar safeguards and ongoing monitoring. That is not a formal clearance.

The shared principle: legitimate interest can justify training on publicly available first-party content when there is an opt-out. Consent is not required in these cases.

Brazilian ANPD (June 2024)

The ANPD suspended Meta's processing of Brazilian user data for AI training over insufficient information transparency. That is a different result from the EU DPAs, because the ANPD put transparency ahead of whether legitimate interest was admissible. The preventive measure was lifted on 30 August 2024 after Meta submitted a compliance plan.

The irreversibility problem

Cookie consent was designed for real-time, reversible tracking. Training data is different. Once data enters the model weights, there is no practical way to erase it surgically. Retraining from scratch is the one complete remedy, and it is prohibitively expensive.

Partial remediations:

  • Unlearning. Approximate removal; measured by MIA (Lesson 22).
  • Influence function-based localization. Identify weights most influenced by the data; selectively update.
  • Fine-tune-suppression. Train the model to refuse outputs derived from the data.

None of these fully solves the problem, which is why the compliance window is collection time.

Data Provenance Initiative

dataprovenance.org. Longpre, Mahari, Lee et al., "Consent in Crisis" (July 2024), audited the AI training data commons at scale. Publishers are adding robots.txt restrictions at an accelerating rate, so the commons that is openly trainable is contracting quickly. From 2023 to 2024, about 25% of the top training sources added some restriction. Future training-data availability will depend on new acquisition paradigms: licensing, synthetic generation, and incentivized participation.

Where this fits in Phase 18

Lesson 26 covers model-level documentation and this one covers dataset-level governance. Together they make up the transparency layer. Lesson 28 maps the research ecosystem working on these questions.

Check: The Concept0/23
1. What is California's AB 2013?Define
A card named AB 2013 noting only that it is a California law signed in 2024, with a blank chip asking what kind of law it is.
2. What is the EU Copyright Directive's text-and-data-mining (TDM) exception?Define
A card named TDM exception noting only that it is a provision of the EU Copyright Directive, with a blank chip asking what it allows.
3. What is legitimate interest in the context of AI training?Define
A card named legitimate interest noting only that it is a legal basis sometimes cited for AI training, with a blank chip asking what it means.
4. What is an opt-out signal?Define
A card named opt-out signal noting only that it is a term from the GPAI Code of Practice's copyright rules, with a blank chip asking what it refers to.
5. What does irreversibility mean for training data?Define
A card named irreversibility noting only that it is a property discussed in training-data governance, with a blank chip asking what it means.
6. What is unlearning?Define
A card named unlearning noting only that it is a technique applied after training, with a blank chip asking what it is.
7. What is the "Consent in Crisis" audit?Define
A bare card named Consent in Crisis with no other detail, and a blank chip asking what it is.
8. A developer trains only on a dataset it generated synthetically. Why does the synthetic-data item in AB 2013 still matter?Explain
A developer that trains only on synthetically generated data, next to a card naming AB 2013's own synthetic-data item, with a blank chip asking why that item still matters.
9. Why does the personal-information item in AB 2013 matter beyond the disclosure itself?Explain
A card naming AB 2013's own personal-information item, with a blank chip asking why it matters beyond the disclosure itself.
10. What is the convergent 2025 DPA principle for LLM training on publicly available first-party content?Explain
Four named 2025 regulatory decisions, Irish DPC, Cologne court, Hamburg DPA and UK ICO, each with only one bare public date or fact, and a blank chip asking their shared principle.
11. How did the Brazilian ANPD's 2024 action on Meta differ from the 2025 EU DPA outcomes?Explain
Two bare cards, Brazilian ANPD with its 2 July 2024 decision and EU DPAs with their 2025 decisions, with a blank chip asking how Brazil's reasoning differed.
12. Why must opt-out and provenance checks happen at collection time rather than after training?Explain
A three-stage pipeline, collection, training and deployment, with the collection stage highlighted and a blank chip asking whether a missed check there is fixable later.
13. Which of these is NOT a partial remediation for the irreversibility problem?Explain
A model weights box already trained, with an arrow into a request card reading remove this data, and a blank chip asking which candidate approach is not a real remedy.
14. Why is the cookie-consent model a poor fit for training data?Explain
Two bare named boxes, cookie consent and trained model weights, with a blank chip asking why the cookie model fails here.
15. How does the TDM exception differ from legitimate interest?Explain
Two cards, TDM exception noted as a copyright-law provision and legitimate interest noted as a privacy-law term, with a blank chip asking how they differ.
16. What does the Consent in Crisis audit imply for future training-data availability?Explain
A single stat tile reading about 25 percent of top training sources added a new restriction between 2023 and 2024, with a blank chip asking the implication for future availability.
The 25% figure is from the lesson's own text, not invented.
17. A dataset is still being scraped every week. Which AB 2013 item requires the summary to carry a notice about this?Apply
A dataset card noting only that it is scraped every week and collection is ongoing, with a blank chip asking which AB 2013 item flags this.
18. A startup trained a model two years ago on scraped data. A user now demands erasure of their post under GDPR. What is the realistic position?Analyze
A startup that trained a model two years ago on scraped data, next to a user who now demands erasure of their post citing GDPR, with a blank chip asking the realistic position.
19. A lab finds that pages from a site with a robots.txt training restriction ended up in its trained model. Which control failed?Analyze
A lab's trained model noted to contain pages from a site whose robots.txt restricted training, with a blank chip asking which control failed.
20. Company X trains on its own users' public posts with an opt-out and safeguards. Company Y scrapes third-party sites that carry robots.txt restrictions, citing legitimate interest. Which statement is right?Analyze
Two company cards, Company X training on its own users' public posts with an opt-out and safeguards, and Company Y scraping third-party sites with robots.txt restrictions while citing legitimate interest, with a blank chip asking which claim is right.
21. A provider has a strong legitimate-interest analysis for training on user posts but told users almost nothing about it. Under the Brazilian ANPD's 2024 approach, what is the likely outcome?Analyze
A provider card noting a strong legitimate-interest analysis paired with almost no user transparency, with a blank chip asking the likely outcome under Brazil's 2024 approach.
22. A new provider will train on a mix of web pages and user posts. Which plan best fits the lesson's ideas?Design
A new provider card noting it will train on web pages and user posts, with a blank chip asking the best plan.
23. A lab expects fewer openly trainable web sources over time. Which approach fits, and what must it still record?Design
A lab card noting it expects fewer openly trainable web sources over time, with a blank chip asking the best approach and what to still record.

Use It

code/main.py prints a California AB 2013 12-field dataset summary for a toy dataset. Fill in the fields yourself and watch which ones trigger privacy or copyright follow-on obligations.

Check: Use It0/5
1. main.py's follow-up logic receives a summary where contains_personal_information is "Y" and the copyright, licensed, aggregate and synthetic answers are all "N". What does it print?Apply
A table of five input flags for main.py's flag_followups, personal info Y and every other flag N, above a masked output box.
The input flags are the question's own given values.
2. A summary has the copyright field "Y (licensed news archive)", purchased_or_licensed "Y", and every other answer "N". Which follow-ups does flag_followups return?Apply
A table of five input flags for main.py's flag_followups, copyright Y (licensed news archive) and licensed Y, every other flag N, above a masked output box.
The input flags are the question's own given values.
3. In a summary, contains_personal_information is "Y (some records)" and every other answer is "N". What happens in flag_followups?Apply
A table of five input flags for main.py's flag_followups, personal info Y (some records) and every other flag N, above a masked output box.
The input flags are the question's own given values.
4. When main.py runs on TOY_EXAMPLE, which follow-up appears under Follow-up obligations triggered?Apply
A table of main.py's own TOY_EXAMPLE input flags, personal info, aggregate info, copyright and licensed all N and synthetic Y, above a masked output box.
The input flags are copied from main.py's own TOY_EXAMPLE dictionary.
5. A team says its provenance script reported no problems, so the corpus honours robots.txt. What is wrong with that conclusion?Analyze
A team's provenance script running clean and reporting no issues, next to the team's quoted conclusion that their corpus honors robots.txt, with a blank chip asking what is wrong with this.

Ship It

This lesson produces outputs/skill-provenance-check.md. Given a dataset used in training, it checks for AB 2013 12-field coverage, opt-out infrastructure compliance, DPA alignment, and irreversibility-risk assessment.

Author's Note

I'd run main.py first and read the output with the 12 items in front of you. The toy dataset is a hand-written dict with one key per statutory item, and render_markdown prints them in order. Nothing generates the data. The dict just describes a synthetic set, so the summary tells you what a filled-in answer looks like, not how to produce one.

The part worth your time is flag_followups. It reads a few of the answers and emits the obligations they trigger: personal information points at CPRA, a copyright flag points at EU TDM opt-out, synthetic data points at the base model used to generate it, and a license points at keeping provenance records. Because the toy set is entirely synthetic, only the synthetic-data flag fires. Edit a field to "Y" and rerun to see the others show up.

Know where the scaffold stops. The personal-information and aggregate-consumer checks compare against exactly "Y", so an answer like "Y (some records)" slips past them, while the copyright and synthetic checks only look at the first character. It also does not inspect robots.txt or any opt-out signal. It reminds you that you owe that respect, and the collection-time work stays with you.

Exercises

  1. Run code/main.py. Produce a 12-field summary for a toy dataset and identify which fields are under-specified.

  2. The EU Copyright Directive TDM opt-out is machine-readable. Propose a standard format for the opt-out signal and compare it to robots.txt and C2PA "No AI Training."

  3. Read the Data Provenance Initiative's "Consent in Crisis" (July 2024). Describe the three fastest-restricting content categories and argue one economic consequence.

  4. The 2025 DPA alignment accepts legitimate interest for public-content training. Construct a scenario in which legitimate interest would not suffice and identify the legal basis a provider would need instead.

  5. Sketch a training-data-provenance manifest that composes with the AB 2013 fields and a C2PA-signed provenance chain for each dataset. Identify one technical and one legal barrier.

Key Terms

TermWhat people sayWhat it actually means
AB 2013"the California law"Generative AI training-data transparency; 12 mandated fields
TDM exception"text-and-data-mining"EU Copyright Directive training-data exception with opt-out
Legitimate interest"the EU basis"GDPR Article 6 basis that may justify training on public content
Opt-out signal"machine-readable no-train"robots.txt, C2PA "No AI Training," TDM.Reservation
Irreversibility"cannot un-train"Data in model weights is not surgically removable
Unlearning"approximate removal"Post-training interventions to reduce model dependence on specific data
Consent in Crisis"the DPI audit"July 2024 finding of accelerating robots.txt restrictions

Further Reading

Code

Ships With