Data privacy laws for AI training data by country

Privacy law decides whether the personal data inside your records can be licensed for AI training, and the answer changes at every border. This guide starts with the US federal and state position, then compares 17 jurisdictions in one table, with a link to the main AI-training guidance in each.

It summarizes what the laws and regulators say as of November 2026. It is not legal advice for your records, and the rules are moving quickly, so take independent advice in each country where your data subjects live. For a step-by-step view of the three biggest regimes, see our guide to UK GDPR, EU GDPR and CCPA.

Is there a US federal privacy law for AI training data?

There is no comprehensive US federal privacy law for AI training data. Federal rules come from the FTC Act, sector statutes and a national security rule on foreign transfers.

The DOJ rule matters for licensing. A license that gives a covered person linked to a country of concern access to bulk sensitive personal data can be a prohibited or restricted transaction, and due diligence and audit duties for restricted transactions applied from October 5, 2025. Every buyer we introduce is verified for company identity and onward transfer limits before seeing a sample.

Which US states have comprehensive privacy laws?

23 US states have passed comprehensive consumer privacy laws, and 19 are in force as of November 2026. The Future of Privacy Forum's effective dates chart lists the dates below. Florida's Digital Bill of Rights is left out because it applies only to a narrow set of businesses.

Counts of 24 states, such as MultiState's, include Florida. State attorneys general enforce these laws, and California also has a dedicated regulator, the California Privacy Protection Agency. Our US seller guide and California seller guide go further on the state rules.

What do US state privacy laws mean for AI training data?

US state privacy laws mostly regulate AI training data through three rules: the definition of a sale, consent for sensitive data and the exclusion for deidentified data.

• Sale: the CCPA treats a transfer of personal information for monetary or other valuable consideration as a sale, so a paid license of identifiable customer records triggers opt-out and notice duties
• Sensitive data: Vermont's law requires prior consent to process sensitive data and consent to process data for a material new purpose, according to Mayer Brown, and other states set their own consent rules
• Deidentified data: in California, data that meets the deidentified standard falls outside the definition of personal information. The test in Civil Code section 1798.140(m) needs reasonable technical measures, a public commitment not to re-identify and contracts binding every recipient
• Training data disclosure: California's AB 2013, in force since January 1, 2026, requires developers of public generative AI systems to post a summary of training datasets, including whether they contain personal information as defined by the CCPA, according to Crowell and Moring

Illinois adds the Biometric Information Privacy Act for faces, voices and other biometric identifiers, and Washington's My Health My Data Act covers consumer health data. Our de-identification guide explains how to meet the deidentified standards in practice.

Privacy laws for AI training differ most on lawful basis and transfers, and agree more on anonymization. The table compares 17 jurisdictions, with the main AI-training guidance linked in the last column.

What do European regulators say about AI training data?

European regulators say AI training on personal data can be lawful under legitimate interests, but only after a documented balancing test, real transparency and an easy way to object. The EDPB's Opinion 28/2024, adopted on December 18, 2024 at the request of the Irish authority, sets the common approach.

National regulators have applied it. Ireland's Data Protection Commission said on May 21, 2025 that Meta had added updated notices, a simpler objection form, de-identification and output filters before training on adults' public posts from May 27, 2025. France's CNIL said on June 19, 2025 that AI development "does not always require" consent, while listing safeguards such as excluding certain data from collection.

The UK went the same way. The ICO's December 2024 consultation response says developers relying on legitimate interests must show why other sources, such as licensed datasets from publishers, will not work. That makes properly licensed company data a stronger position for a buyer than scraped data. Our UK seller guide covers the UK rules in more detail.

What do regulators outside Europe say about AI training data?

Regulators outside Europe mostly start from consent or reasonable expectations, which makes reusing customer records for training harder than in the EU.

• Canada: the OPC's December 7, 2023 principles say organizations should "Know and document their legal authority" across the AI lifecycle and that public accessibility "does not mean that it can be indiscriminately collected or used"
• Australia: the OAIC's October 21, 2024 guidance says training is usually a secondary use under APP 6, that a privacy policy update alone generally will not change expectations for data collected earlier, and recommends consent or a meaningful opt-out where the tests are not clearly met
• Singapore: the PDPC's March 1, 2024 guidelines allow the business improvement and research exceptions, and encourage anonymizing datasets "as far as possible instead of using personal data"
• South Korea: the PIPC announced that the National Assembly passed a PIPA amendment on August 20, 2026 allowing lawfully collected data to be used for AI development where pseudonymized or anonymized data is not enough, with enhanced safeguards
• Brazil: the ANPD ordered Meta on July 2, 2024 to suspend a privacy policy allowing AI training, finding preliminarily that users did not expect old posts to train AI, with a daily fine of R$50,000 for noncompliance
• China: Article 7 of the Interim Measures for generative AI services requires lawful sources and, where personal information is involved, consent or another legal ground

India's Digital Personal Data Protection Rules 2025 were notified in November 2025 with a phased rollout of 12 to 18 months, so most duties are still being phased in. Our Canada and Australia seller guides go further for those markets.

What does this mean for a company licensing its own records?

For a company licensing its own records, the safest position in almost every jurisdiction is to remove personal data or de-identify it to the local standard before any buyer sees it. Where personal data must stay in, you need a lawful basis that covers the new use and a privacy notice that supports it.

1. 1

   Map where data subjects live

   The law that applies usually follows the people in the records, not where your servers are.

2. 2

   Check the notice in force at collection

   Compare what you told people with AI training. The FTC, the ICO and the OAIC all look at what people were told and could expect.

3. 3

   Choose exclude, de-identify or keep

   Exclude sensitive and HR data, de-identify to the strictest standard that applies and document the method.

4. 4

   Check the transfer route

   Identify where the buyer will store the data and which transfer mechanism, if any, the law requires.

5. 5

   Write it into the license

   Set use limits, a ban on re-identification and onward transfer limits, as in our licensing agreement checklist.

Privacy notice and lawful basis is one of the eight checks in our seller vetting standard, and de-identification method is another. If you want to know which of your records can be licensed and where, request a free data valuation. Sellers pay nothing to be assessed.