In a prior article Training AI Models – Just Because It’s “Your” Data Doesn’t Mean You Can Use It, we addressed how many companies are sitting on a trove of customer data and are realizing that this data can be valuable to train AI models. We noted, however, that the use of customer data in a manner that exceeds or otherwise is not permitted by the privacy policy in effect at the time the data was collected could be problematic. As companies think through these issues, some have (or will) update their Terms of Service (TOS) and/or privacy policy to address this. Before companies do this, it is critical to make sure they do not jump out of the frying pan and into the fire.
In recent guidance, AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive (“Guidance”), the FTC warned:
It may be unfair or deceptive for a company to adopt more permissive data practices—for example, to start sharing consumers’ data with third parties or using that data for AI training—and to only inform consumers of this change through a surreptitious, retroactive amendment to its terms of service or privacy policy.
The FTC further warns that market participants should be on notice that any firm that reneges on its user privacy commitments risks running afoul of the law. Simply put, according to the FTC guidance a business that collects user data based on one set of privacy commitments cannot then unilaterally renege on those commitments after collecting users’ data.
Managing the use of data of any type for training AI can implicate a number of legal considerations, as we have previously discussed in The Need for Generative AI Development Policies and the FTC’s Investigative Demand to OpenAI. Companies that train AI models are strongly advised to develop policies to address the many legal issues that can arise. The best way to get started on developing policies is to start with a presentation to the relevant stakeholders in the company, on the legal issues, by a knowledgeable AI attorney to ensure a solid understanding of the issues that need to be addressed and the ramifications of not doing so. From there, the company can work with counsel to develop effective policies and procedures.
For more information on the FTC guidance, see here.