The idea is simple: individuals license their data to AI developers and share in the value. The law is less simple.
Rights, not ownership
Under UK and EU law individuals do not own their personal data as property. They have rights over how it is used. A “licence” from an individual is in practice a contract plus a lawful basis under the GDPR, most often consent. Consent must be specific, informed and freely given, and it can be withdrawn at any time. Sensitive data, such as health or biometric data, needs explicit consent.
A permission that can be withdrawn at any time is a different commercial asset from an irrevocable licence. A trained model cannot easily forget.
Acting for many people
An intermediary that grants permissions on behalf of many individuals needs authority from each of them covering the specific use. Purpose limitation and transparency still apply: individuals should know who receives their data and why. The intermediary and the developer are each likely to be controllers with their own obligations.
Other layers
Where the data includes creative content, such as text, images or voice, copyright applies separately. In the US, state rights of publicity may apply as well. The EU AI Act requires providers of general-purpose AI models to publish a summary of their training content and to have a copyright policy. The UK’s position on AI and copyright remains under review.
US law has no general consent requirement and leaves more to contract, but state laws restrict the sale and sharing of personal data and the use of sensitive data.
Structuring it
Treat the arrangement as a permission with a defined scope and duration. Say how it is revoked. Above all, say what happens to models already trained on the data when it is.
This article is general information on the law as at October 2026. It is not legal advice and has not been updated since that date. See the terms of use.