Do you have the right to train on that data
The data is sitting in your warehouse, so it feels like yours to use. Consent is scoped to a purpose, and the purpose you collected it for is rarely the one you now want to train on.
Do you have the right to train on that data
You have the data. It is in your systems, you paid to collect it, and the model would clearly be better with it. One question rarely gets asked before the training job runs. Are you allowed to use it this way?
Having the data is not the same as having the right
Consent is scoped. When a customer handed over their information, they agreed to a purpose. Process my order. Support my account. Send me the thing I asked for. That agreement almost never included “and train a machine learning model on it.” The data being in your warehouse tells you that you can technically reach it. It says nothing about whether the use you now have in mind is inside the boundary the customer agreed to.
This is a governance problem wearing a technical costume. The pipeline works. The join runs. The feature would ship. And then someone in legal asks where the training data came from, and the answer is a support system whose privacy terms said the records were for handling support tickets. Now the whole model is built on a foundation you cannot defend, and unwinding it means retraining from scratch.
Where the reuse quietly happens
The trap is that reuse feels like reduce, reuse, recycle. You already have chat transcripts from three years of support. Why collect new data when that history is right there? So a team points the training pipeline at it. The transcripts contain names, account details, and things people typed in a moment of frustration expecting a human on the other end, not a training corpus.
Or take a healthcare or fintech context, where the CTO of a firm that ships software into both told me quality starts before the contract is even signed. His team runs discovery, documents each step, and defines what “done” means before a sprint begins. That discipline exists for a reason. In a regulated domain, “we trained on the data we had” is the sentence that ends an audit badly. The purpose the data was collected under is part of the specification, and if you did not check it during discovery, you find out during review.
The three questions that settle it
Before any dataset becomes training data, three questions decide whether you have the right to use it.
- What purpose was this collected under, and does training fall inside it?
- Did the people it describes consent to this specific use, or only to the original one?
- If a customer asked you to delete their data tomorrow, can you honor that after it is baked into the weights?
That third one catches teams off guard. A record in a database is deletable. The influence of that record on a trained model is not, at least not cleanly. If your legal basis depends on being able to remove someone’s data, training on it may quietly break a promise you already made.
Consent is a readiness dimension, not a blocker at the end
The mistake is treating this as a checkbox at the finish line. By then the pipeline is built and the pressure to ship makes “we probably have the right” sound good enough. Governance is one of the dimensions that decides whether data is ready for a use case at all, and it sits at the same level as data quality and architecture. A dataset can be clean, complete, and perfectly shaped, and still be off-limits for the thing you want to build. Checking that early costs a conversation. Checking it late costs the model.
How we approach it at Density Labs
In the AI Opportunity Assessment, our fixed two week, $2,500 engagement, we treat usage rights as part of data readiness, not a legal afterthought. For each data source a feature wants to use, we ask what it was collected for, what consent covers it, and whether training or retrieval falls inside that scope. We would rather flag a rights problem in week one than watch a finished model get pulled because the data underneath it was never yours to train on.
The data being yours to hold is not the same as it being yours to train on.