--- title: Can I train or fine-tune a model on my users' data? description: What decides whether user or customer data can be used for training, including promises already made, contracts, sensitive data, and the risk of having to delete a model. category: AI features service: ai-feature-review updated: 2026-11-12 --- ## Short answer Sometimes, but having the data lawfully does not by itself give you the right to train on it. What decides it is why the data was collected, what you promised users, whether the data is sensitive, and whether you hold it as a service provider for business customers. The most serious risk is that a model trained on data you had no right to use may have to be deleted, not just the data. ## Three different activities Don't treat these as the same thing. Each needs its own legal basis. - **Inference**: using a user's data to perform the task they asked for. - **Customer-specific improvement**: tuning the product for one customer, within the permissions that customer granted. - **General training**: using one user's or customer's data to improve models or services for others. The first is usually covered by providing the service. The third almost always needs separate permission. ## What decides it ### What you promised when you collected the data Your privacy policy, consent screens, app store privacy labels, and marketing all count. In 2024 the FTC warned AI companies that their privacy commitments cover how they collect, keep, share, and train models on customer data. It also warned that quietly or retroactively changing privacy terms to allow AI training of data already collected could be unfair or deceptive. No single federal rule requires opt-in consent for every change, but expanding the use of existing data in a way that contradicts earlier promises can violate the FTC Act. Clear notice and affirmative consent are often what it takes to avoid that, and an updated policy alone may not make an earlier unauthorized use lawful. ### Contracts with business customers If you sell to businesses, their contracts and data processing addenda usually limit what you can do with their data, often to providing the service. Training a shared model on one customer's data, which can then help other customers, typically needs explicit permission in the contract. ### Health care customers and HIPAA If you handle patient information for a HIPAA-covered provider, your business associate agreement controls. You may use protected health information only as the agreement and HIPAA permit, and a training clause in your general terms cannot override that. Generating the clinical note a provider asked for is different from using that encounter to improve a model for other customers; the second needs its own analysis, and possibly de-identification. ### Sensitive data under state privacy laws Most states with comprehensive privacy laws require opt-in consent before processing sensitive data, including Virginia, Colorado, Connecticut, Oregon, Texas, Montana, Delaware, New Jersey, Tennessee, and Maryland (which adds data-minimization limits). California instead gives users a right to limit certain uses of sensitive data, and Utah and Iowa rely mainly on notice and opt-out. Connecticut's July 2026 amendments tightened limits on processing sensitive data and on materially new uses of existing data. Specialized laws such as Washington's My Health My Data Act and COPPA add their own requirements. ### Purpose limits in privacy laws Several state privacy laws, and the GDPR for EU users, limit use of personal data to purposes compatible with what users were told. General training is often not compatible with the original purpose. ## The model-deletion risk The FTC has repeatedly required companies to delete not only improperly collected data but the models and algorithms built from it: - **Everalbum** (2021): facial recognition models built from users' photos. - **Weight Watchers / Kurbo** (2022): algorithms derived from children's data collected in violation of COPPA. - **Edmodo** and **Ring** (2023): models and algorithms derived from improperly collected children's data and improperly accessed videos. - **Rite Aid** (2024): data, models, and algorithms from its facial recognition system. - **Avast** (2024): browsing data and the models, algorithms, and products derived from it, with $16.5 million in monetary relief. These were cases about deceptive or unlawful data practices, not rulings that AI training is itself prohibited. But if a model is central to your product, the legal basis for its training data is a business-continuity question, not just a compliance one. ## Ways to make training workable - Ask for consent going forward, separately from the terms, with a real choice. Train only on data from users who agreed, and keep the permission auditable. - Offer business customers an opt-in, often with something in return. - Use properly de-identified or aggregated data, but be careful: data that can be re-identified, or text that contains personal details, is still personal data. - Keep raw training data only as long as needed. - Make sure your model provider cannot use customer data beyond the purposes you authorized. - Record which data went into which model version, so you can honor deletion requests and prove what you used. ## Checklist an agent can run against the codebase - [ ] Find every pipeline that exports user data for training, fine-tuning, evaluation, or prompt examples, and classify each as inference, customer-specific, or general training. - [ ] List the data categories each pipeline uses and flag sensitive categories. - [ ] Check whether the pipeline filters by a consent flag, and where that flag is set. - [ ] Check whether training datasets and model versions are recorded so data can be traced to models. - [ ] Check the model provider's settings for training and retention on your data. - [ ] Compare the results to the privacy policy, consent screens, app store labels, customer contract templates, and any business associate agreements. ## If this applies to you An **AI feature review** covers training plans, including consent, contract changes, and a build spec for consent-gated training pipelines. Adding training to an existing feature is a **pre-build feature check**.