In September 2025 Anthropic agreed to pay about 1.5 billion dollars, roughly 3,000 dollars a book across nearly 500,000 titles, for books it downloaded to train Claude. That is the largest copyright settlement in US history, and it is the clearest price tag anyone has put on a question most marketers never ask: what is inside these models, and who actually owns it?
The honest answer has three parts, because "the data" is really three separate things that get owned by three different people. There is the raw data the model learned from. There is the model itself. And there is whatever the model spits out when you prompt it. Confuse those three and every AI-and-copyright headline reads like noise. Keep them straight and it gets clear fast. Your website is very likely in the first bucket, so this is not an abstract legal debate. It is your content.
What "training data" actually means
A large model is not trained in one pass on one pile. It is built in layers, and the layers matter because they come from different places and carry different rights.
The bottom layer, by far the biggest, is pretraining on raw text and images scraped from the open web. This is where the model learns language, facts and patterns. The second layer is curated and licensed data: cleaner, higher-quality sources a company either filters hard or pays for. The top layer is fine-tuning and human feedback, where paid annotators rate answers and write examples to shape how the model behaves. When you hear a model is "trained on the internet," that is only the first layer talking.
We are not guessing at the mix. OpenAI's own GPT-3 paper disclosed the recipe: about 60 percent filtered Common Crawl (a public web archive), around 22 percent a corpus built from outbound Reddit links, roughly 16 percent split across two book collections, and 3 percent Wikipedia. Newer models are more secretive about their exact blends, but the shape is the same. Web scrape first, everything else layered on.
Where the data comes from
Most of the base layer traces back to a handful of sources you have probably never heard of but have very likely contributed to.
Common Crawl is the big one. It is a nonprofit that has spent years archiving the public web, billions of pages and hundreds of terabytes per snapshot, and releasing it for free. A 2024 analysis presented at the ACM FAccT conference called it the single largest source for generative AI training data. GPT, Llama and Gemini all lean on it or on cleaned versions of it. C4, short for Colossal Cleaned Crawled Corpus, is Google's scrubbed 750-gigabyte cut of Common Crawl, built to train its T5 model and reused widely since.
The Pile is an 825-gigabyte open dataset from EleutherAI that stitches together 22 sources: academic papers, PubMed, GitHub code, and a book set called Books3. Books3 is worth naming, because it contained roughly 196,000 books pulled from a pirate library, and it became legally radioactive once authors realized their work was in it. LAION-5B is the image equivalent: 5.85 billion image-and-caption pairs scraped from Common Crawl's alt-text, the fuel behind Stable Diffusion. It was pulled offline in late 2023 after Stanford researchers found illegal material in it, then re-released once that content was removed.
Then there is the paid layer. Since late 2023, AI companies have been signing publishers directly. OpenAI's deal with News Corp is reported at up to 250 million dollars over five years, covering the Wall Street Journal and dozens of other titles. It reportedly pays Axel Springer, the Financial Times, The Atlantic, Vox Media, Time and Conde Nast too. Reddit licensed its content to Google for a reported 60 million dollars a year, then signed OpenAI as well. This is the split that should worry a small brand: the New York Times can sue or get paid. Your company blog gets scraped for free.
Your content is in the training set
Here is the part that turns this from law-school trivia into a marketing decision. If your site is public and it is not actively blocking crawlers, it has been eligible for AI training for years. The scrapers do not ask.
You can push back at the door with robots.txt, and plenty of people are. By late 2025 roughly 5.6 million sites were disallowing OpenAI's GPTBot in robots.txt, up from about 3.3 million in July, per crawler-tracking data reported by The Register. Studies of top news sites put the blocking rate for AI training bots near 79 percent. So the biggest publishers are slamming the door, which is one more reason the little sites are overrepresented in what gets taken freely.
But blocking is a blunt instrument, and this is where marketers get it backwards. Robots.txt only asks nicely, and even when it is honored, it governs training crawlers, not whether an AI can cite you. Research in 2025 found that blocking AI crawlers did not stop those sites from being cited in AI answers, because the answer engines pull live context from search indexes and other sources at query time. So you can lock the training door and still show up in the answer, or lock it and lose the visits without gaining much protection. I wrote about that trade-off in backlinks versus brand mentions, and it is the same lesson here: presence in the answer is a different game than control of the training set.
Who owns the raw data
Short version: you still do. Copyright attaches the moment you create something, and nobody scraping your page transferred that copyright to themselves. The whole fight is about whether copying your work into a training set without permission is infringement, or whether it is "fair use" because the model is doing something transformative.
The courts are splitting the difference in a way that is starting to look consistent. In the Anthropic case, Judge William Alsup ruled in June 2025 that training on books the company had legally acquired could be fair use, but that downloading pirated copies from shadow libraries was not. The piracy is what triggered that 1.5 billion dollar settlement. Read the two halves together and the message is blunt: the training might be defensible, the theft to get the material is not.
The New York Times case against OpenAI and Microsoft, filed in December 2023, is the one to watch for the general rule. In 2025 the judge let the core copyright claims proceed rather than tossing them, and summary-judgment briefing runs into 2026. There is no final ruling on whether the training itself was fair use, so anyone who tells you the law is settled is selling something. Across the Atlantic, Getty Images mostly lost its UK case against Stability AI in November 2025, but on narrow procedural grounds (Getty could not show the training happened in the UK), not a clean win for AI companies.
The clearest official signal came from the US Copyright Office. In its May 2025 report on generative-AI training, the Office said that using copyrighted works to train a model can implicate an owner's rights, and that making commercial use of vast troves of works to produce content that competes with them, "especially where this is accomplished through illegal access," goes beyond established fair use. It stopped short of asking for new laws and pointed instead at voluntary licensing. Translation: expect more deals, more lawsuits, and a long gray zone in the middle.
Who owns the model
This part is simple. The trained model, the weights, belongs to the company that trained it. OpenAI owns GPT, Google owns Gemini, Anthropic owns Claude. That is true even though the model learned from millions of other people's work, which is exactly what makes the raw-data fight so heated. The value got concentrated into an asset owned by one company, and the people whose work fed it are arguing over whether they are owed anything for it. An "open-weights" model like Llama is a partial exception: you can download and run the weights, but under a license with conditions, not a handover of ownership.
Who owns the output
This is the one marketers get wrong most often, because there are two different questions hiding inside it: who has the rights to use it, and whether it is protected by copyright at all. They have different answers.
On usage, the major providers hand the output to you. OpenAI's terms assign you whatever right, title and interest it has in what you generate, and the others are similar. So for practical purposes, the ad copy or image you generate is yours to use commercially.
On copyright protection, the answer is often nobody. The US Copyright Office ruled in early 2025 that human authorship is required, so a work generated purely by AI cannot be registered. Typing a prompt, even a long and clever one, does not count as authorship on its own. You get protection only for the parts a human meaningfully shaped: your edits, your arrangement, your own words woven in. So that fully AI-generated image your competitor is running? They can use it, but they may not be able to stop anyone else from using it too. For brand assets you want to defend, that is a real reason to keep a human hand on the work.
The trap most marketing teams walk into
Everything above is about content you publish on purpose. The bigger risk is the data you never meant to feed a model at all: your customer list, your CRM notes, your unreleased campaign, the deal terms in a contract you paste in for a quick summary.
Ownership of that data does not change when you paste it. It is still yours. What changes is who else has seen it and what they are allowed to do with it. Consumer AI tools and business tiers treat your inputs very differently. Enterprise and API plans from the major providers generally promise not to train on your data by default. Free consumer chatbots have, at various points, used conversations to improve their models unless you dug into a setting and turned it off. If you would not email a document to a stranger, think twice before dropping it into a chat box you have not checked the terms on.
The safe pattern is boring and it works: keep first-party and customer data out of consumer AI tools, use business tiers with a no-training commitment for anything sensitive, and clean the data before it goes anywhere. A quick pass through a client-side tool like the CRM Data Cleaner runs entirely in your browser, so you can standardize a list without uploading it to anyone in the first place. Same principle as every tool on this site: your data never leaves your machine. The cheapest way to win the ownership argument is to never hand the data over.
What to actually do with this
You do not need a law degree, you need a position. Decide, on purpose, whether you want your content in these models. If being cited in AI answers is worth more to you than the training use bothers you, stay open and write for it. If you have proprietary research you would rather license than give away, block the training crawlers and know that citations may still find you anyway.
Keep the three buckets straight when you read the news. A ruling about training data does not tell you anything about who owns the output. Keep a human meaningfully involved in anything you want to protect as a brand asset. And treat your customer data as the crown jewels it is, because that is the one piece of this whole picture you actually control.
The models were built on a decade of the open web, most of it taken without a conversation. The law is racing to catch up and the licensing market is forming in real time. The question worth sitting with is not whether AI trained on your work. It did. Have you decided what you want to happen the next time it does?
Amit