US law and AI training data: which rule applies to which question
There is no single US AI data statute. Instead, a patchwork of federal and state rules turns on what is in the dataset and who is in it. This map starts from the question, not the statute.
Start from the question
- Question Who is in the data, and what is in it?
- Rule FTC Act, CCPA, HIPAA, BIPA, COPPA, copyright.
- Evidence Notices, consents, de-identification.
Questions to rules
| If your answer is yes… | Look at | Why |
|---|---|---|
| Data came from your users or customers | FTC Act §5, your privacy policy | Changing data use without notice can be deceptive |
| Californians are in the data | CCPA/CPRA | Sale/sharing rights and notice |
| It includes health data from a covered entity | HIPAA | De-identification standards before disclosure |
| It contains face or voice biometrics | Illinois BIPA and similar state laws | Written consent; private right of action in Illinois |
| Children under 13 are involved | COPPA | Verifiable parental consent |
| It includes others' creative works | Copyright Act; USCO AI report | Title and licensing; contested fair use |
| Buyer offers generative AI in California | AB 2013 | Buyer must publish training data documentation |
Moving target
State privacy laws and AI-specific bills change frequently. Treat this page as a starting map and confirm current requirements with counsel.
How this affects value
Each rule that applies adds a diligence step; documenting compliance up front keeps it from becoming a discount.
See what shapes a dataset's value