Data provenance checklist for training sets
Before you buy or commission training data, get written answers to five questions: where the data came from, what rights pass to you, how the people in it consented, which licenses travel with it, and what paperwork proves all of that later. The 21 checks below are the ones that most often decide whether a dataset can be used.
Written for buyers, 7 November 2026. Not legal advice.
Where did the data come from?
- Named originThe vendor can say who created each part of the set: its own contributors, a licensed publisher, a public source, a client, or a generator model.
- Collection date rangeYou know when the material was gathered. Older material may predate the consents or licenses now in use.
- Collection methodCommissioned work, crowd tasks, scraped pages, purchased archives, recorded sessions or synthetic output, stated per component rather than for the set as a whole.
- Chain of titleIf the vendor licensed the data from someone else, it can show that its own license lets it sublicense to you for training.
What rights do you actually get?
- Training use is namedThe license says machine learning training in words, not just "internal use" or "analytics".
- Commercial useYou may ship a commercial model trained on it, not only run research.
- Exclusive or notWhether other buyers can license the same data, and for how long. Exclusivity usually costs a multiple of a standard license.
- Term and survivalWhat happens to a trained model if the license ends. A clause that lets a model survive expiry matters more than the expiry date.
- Derivatives and outputsWho owns labels, rewritten text or synthetic data produced from the set, and whether you may share them.
People, consent and personal data
- Contributor agreementsAnnotators, writers and speakers signed terms that cover AI training, and the vendor can show a template.
- Personal data removedNames, contact details, account numbers and faces are removed or masked before delivery, with the method described.
- Voice and likenessRecordings of voices or faces have consent that covers training. Voiceprints can count as biometric data under Illinois BIPA, Texas CUBI and Washington law.
- ChildrenThe vendor states whether any material involves minors and how consent was handled. If it cannot say, treat the set as unsuitable.
- Opt-outs honoredWhere creators can withdraw, the vendor explains how withdrawals reach buyers who already hold a copy.
Licenses inside the set
- Open licenses keptCode and text under open-source or Creative Commons terms keep those terms. Attribution or share-alike conditions can follow the data.
- No terms-of-service conflictsMaterial taken from platforms whose terms forbid scraping or AI training is flagged or excluded.
- Copyright clearanceFor published works, the vendor holds a license from the rightsholder or a collective, not just access to copies.
Paperwork to keep
- DatasheetA written description of contents, sources, collection dates, known gaps and intended uses.
- Warranty and indemnityThe vendor warrants it has the rights it is selling and says what it covers if a claim arrives.
- Deletion and audit termsHow you prove deletion at the end of a term, and whether the vendor may audit your use.
- Version recordA hash or manifest of what was delivered, so you can show later exactly which data trained which model.
How to use the checklist with a vendor
Send it as a questionnaire before pricing, not after. A vendor that answers quickly and in writing has usually done this before; one that answers only on a call, or only for its "enterprise" tier, is telling you something too.
Treat a missing answer as a no. If a vendor will not name the origin of a component, budget either to replace that component or to remove it.
Keep the answers with the model's training records. Provenance questions tend to arrive months later, from a customer's procurement team or a rightsholder, and by then the people who bought the data may have moved on.
Statutes cited
- 740 ILCS 14: Illinois BIPA
- Tex. Bus. & Com. Code § 503.001: biometric identifiers
- RCW 19.375: Washington biometric identifiers
Provenance questions
What is data provenance in AI training?
Provenance is the documented history of a dataset: who created each part, when, under what terms, and every hand it passed through before reaching you. For training data it is the evidence that you had the right to use the material.
Does buying from a large vendor mean the rights are clear?
Not by itself. Size says nothing about the license chain of a specific dataset. Ask for the same documents from every vendor and compare the wording of the training-use clause.
Is synthetic data free of provenance questions?
No. Synthetic data inherits questions from the seed data and the model that generated it: whether the seed data could be used, and whether the generator's terms allow its output to train another model.
Who should read the license before we sign?
Your own lawyer. This checklist helps you ask vendors the right questions; it is not legal advice, and contract terms differ from deal to deal.
Do you check vendors' provenance for us?
No. Vendors are never tested or audited here; the directory simply restates what each one publishes, dated.
Get a quote
ZIP code first, then an email for our answer, then a sketch of the dataset. A person here compares the sketch with the vendors in the index and writes back naming the ones whose own terms fit.
Introductions only: we are not a training data vendor, and the vendor we connect you with may pay us a fee.
Received. Nobody outside this site has it.
- Someone here sets your sketch against the index: data types, pricing basis, published minimums.
- You get an email listing the vendors that match, each with the reason and a link to its own site.
- Approve any of them by reply. Until you do, the brief goes nowhere, and the address you gave is used for nothing else.