Training-rights clauses: who can train AI on your data

A training-rights clause is the language in a vendor's terms, privacy policy, or DPA that governs whether the vendor — or its AI subprocessors — may train machine-learning models on the data you submit. In the AI era it is one of the highest-signal clauses in any vendor agreement.

Why it matters now

Before generative AI, "how a vendor uses your data" was largely about analytics and product improvement. Now it can mean your data becoming training input for a model whose outputs you cannot control or recall. A permissive training-rights clause can turn confidential inputs into a permanent contribution to someone else's model.

Where the clause hides

• The privacy policy, under "how we use data" or an "AI features" section.
• The DPA, in the processing-purposes or subprocessor terms.
• Product-specific terms for an AI feature, separate from the master agreement.

Reading it well

Look for whether the vendor permits training outright, permits it with an opt-out, prohibits it, or says nothing; whether it applies to customer content or only aggregated data; whether it extends to subprocessors; and whether enterprise plans carve it out. The same vendor often treats free, pro, and enterprise tiers differently.

Monitoring it across vendors

A training-rights posture is not static — vendors revise these terms as they add AI features. Tracking it once is not enough; you need to know when it changes. Driftline tracks each monitored vendor's training-rights posture in their live documents and alerts you when it shifts, so "who can train on our data" is a question you can answer at any moment, not reconstruct during an incident.