Global divergence intensifies over AI training on publicly available personal data

As countries grapple with the legal and ethical implications of training AI models on publicly accessible personal information, divergent regulatory approaches threaten to reshape global AI leadership and privacy protections.

Should AI models be permitted to train on personal information that is publicly available on the Internet? The question is no longer theoretical; how countries answer it will shape which jurisdictions foster large-scale AI development and which prioritise stricter privacy protections. According to the Data Innovation report, developers today build generative models from a mix of publicly available web content, licensed archives, user-submitted inputs, proprietary corpora and synthetic data, and much of that publicly accessible material contains personally identifiable information. ^[1]

For decades search engines have operated on the premise that content posted to the open web can be crawled, indexed and repurposed with limited privacy friction. That default is under pressure in Europe. The European Union’s General Data Protection Regulation requires a lawful basis for processing personal data even if it is publicly accessible,and the GDPR’s right to be forgotten has already forced search engines to delist links to lawful material to protect privacy,illustrating that public availability does not automatically confer unfettered reuse. Regulators must now decide whether training AI on scraped web data meets the GDPR’s “legitimate interest” test,an assessment that invites discretion and legal uncertainty. ^[1]

By contrast,the United States maintains a materially different posture:companies generally face few legal restraints on crawling publicly accessible websites,and state privacy regimes such as California’s focus more on data businesses collect directly from consumers than on open-web scraping. That divergence between EU and US frameworks has tangible consequences for where companies choose to train models at scale and how quickly they can iterate. ^[1]

Practical and contractual mechanisms have emerged to mediate these tensions. The robots.txt protocol and newer standards under development at the Internet Engineering Task Force allow site owners to signal whether automated systems may access their content; some publishers have adopted “pay-to-crawl” models to monetise access;and AI firms themselves often avoid scraping websites dominated by personal data. These tools give content owners leverage,even if they were not designed specifically to regulate personal information in model training. ^[1]

Regulators beyond Europe and the US are also asserting limits. In June 2024 Brazil’s national data protection authority ordered Meta to stop using platform data to train AI models,citing risks to individuals’ fundamental rights and criticising opaque opt-out mechanisms,a decision the company called a setback for innovation. The move signalled that privacy-first enforcement is not confined to Europe and that multinational platforms face a patchwork of national requirements. ^[6]

At the same time, US and state-level enforcement is tightening expectations for AI accountability. In April 2024 Massachusetts Attorney General Andrea Campbell issued an advisory reminding developers that consumer-protection,anti-discrimination and data-security laws apply to AI systems and that claims of a model being a “black box” do not excuse biased or unlawful outcomes. The advisory underscores that legal scrutiny will target how systems are built and deployed,not only what data was collected. ^[2]

Legislative efforts are also shaping the transparency landscape. According to the bill text, the Generative AI Copyright Disclosure Act,introduced to Congress in April 2024, would require companies to disclose copyrighted works used in training to the Register of Copyrights ahead of a model’s release and impose penalties for non-compliance,a requirement aimed at protecting creators and increasing visibility into training data provenance. Such proposals,if enacted,would add compliance costs and procedural steps for model publishers. ^[3]

Commercial decisions reflect this regulatory mix. Some firms have modified data policies and introduced explicit opt-ins or opt-outs for user-provided content;Anthropic’s 2025 update required users to choose whether their chats could be used for future training,with prolonged retention for opted-in data, a move the firm said would improve capabilities while critics warned of privacy risks. Meta in 2025 likewise announced a resumption of EU training on publicly posted content after engaging EU regulators and committing to user notifications and objection mechanisms. These developments show companies pursuing different compliance strategies while insisting on the necessity of broad datasets for model quality. ^[5][4]

📌 Reference Map:

##Reference Map:

• ^[1] (Data Innovation) – Paragraph 1, Paragraph 2, Paragraph 3, Paragraph 4
• ^[6] (Time) – Paragraph 5
• ^[2] (AP News) – Paragraph 6
• ^[3] (Wikipedia) – Paragraph 7
• ^[5] (Tom’s Guide) – Paragraph 8
• ^[4] (AP News) – Paragraph 8

Source: Noah Wire Services

Noah Fact Check Pro

The draft above was created using the information available at the time the story first
emerged. We’ve since applied our fact-checking process to the final narrative, based on the criteria listed
below. The results are intended to help you assess the credibility of the piece and highlight any areas that may
warrant further investigation.

Freshness check

Score:
10

Notes:
The narrative is recent, published on January 5, 2026, with no evidence of prior publication or recycled content. The inclusion of recent events, such as the European Union’s GDPR enforcement in 2023 and the United States’ differing approach to web crawling, indicates a high level of freshness.

Quotes check

Score:
10

Notes:
No direct quotes are present in the narrative, suggesting original content. The absence of direct quotations supports the originality of the report.

Source reliability

Score:
10

Notes:
The narrative originates from the Center for Data Innovation, a reputable organisation known for its expertise in data and technology policy. This enhances the credibility of the report.

Plausability check

Score:
10

Notes:
The claims made in the narrative are plausible and align with known developments in AI and data privacy. The discussion of GDPR enforcement in 2023 and the contrasting U.S. approach to web crawling are consistent with existing information.

Overall assessment

Verdict (FAIL, OPEN, PASS): PASS

Confidence (LOW, MEDIUM, HIGH): HIGH

Summary:
The narrative is recent, original, and originates from a reputable organisation. The content is plausible and aligns with known developments in AI and data privacy, indicating a high level of credibility.