Where Does AI Get Its Training Data?

Modern AI systems learn from four kinds of material: text and images collected from the public web, content licensed or bought from publishers and data companies, examples written and rated by paid humans, and synthetic data produced by other AI models. Web crawls supply the bulk of it. None of it is a live feed of the internet, and none of it is the message you typed this morning.

What training data actually is

Stanford's Institute for Human-Centered AI defines training data as the collection of examples, such as text, images, audio or other information, used to teach machine learning models to perform specific tasks. Nobody writes the rules a model follows. The model adjusts millions or billions of internal numbers until it gets better at predicting patterns in the examples it is shown. That process is machine learning, and the examples are the training data.

The collection itself is a dataset: assembled for a purpose and then frozen, which is why a model trained on material gathered in 2024 has no way to notice that something changed in 2026. The International AI Safety Report 2026, chaired by Yoshua Bengio and published in February 2026, states that training datasets have expanded from billions to trillions of data points, at an average increase of 2.5 times a year. A large language model's first and largest learning stage, called pretraining, involves exposure to billions or trillions of examples before any fine-tuning happens.

Where the data comes from

Four kinds of material go in, in roughly descending order of volume, each with a different set of people behind it.

Public web data

Most large models start with a web crawl. The United States Copyright Office, in the pre-publication version of Part 3 of its report on copyright and artificial intelligence, released in May 2025 and not since formally published, put it directly: "One particularly common source of training data is text scraped by web crawlers, often obtained from Common Crawl."

Common Crawl is a nonprofit that has been collecting web pages since 2008 and publishes the results free of charge. Its April 2026 crawl contained 2.19 billion web pages, 379.2 TiB of uncompressed content, and pages from 43.2 million hosts across 35.4 million registered domains, all gathered between 10 and 23 April. Common Crawl's own FAQ states that its crawler checks robots.txt first and fetches a page only if crawling is allowed, and that site owners can block it outright. That is web scraping at industrial scale, done once and published for anyone to use.

Individual companies also run their own crawlers. OpenAI's help center states that its models are trained on "information that is publicly available on the internet," that it does not intentionally gather data from behind paywalls or from the dark web, and that site owners can disallow its GPTBot crawler through robots.txt. Those are OpenAI's published claims about its own systems, not independently audited findings.

Licensed and purchased data

Web data alone is not enough, and increasingly it is not permitted. OpenAI's second stated category is "information that we partner with third parties to access," including datasets obtained through agreements. Across the industry this covers news archives, book catalogues, image libraries, forum content and specialist technical material.

The Copyright Office report also documents routes that are contested, including the use of pirated material from shadow libraries. The Office set out how the fair use factors apply to AI training rather than declaring one answer that settles every case, and the courts have not finished with the question. Training data copyright remains open rather than settled.

Human-created and human-labeled data

A model that has only read the internet is not yet useful to talk to. The step that makes it useful is human work. In OpenAI's 2022 InstructGPT paper, Long Ouyang and colleagues describe collecting a dataset of demonstrations written by human labelers showing the behavior they wanted, using it to fine-tune GPT-3, then collecting a second dataset of human rankings of model outputs and training further with reinforcement learning from human feedback. The resulting model was preferred by human evaluators over a base model 100 times larger.

That pattern is now standard. People write example answers, rank competing outputs, flag unsafe responses and apply category tags, which is the work covered by data labeling. The work is slow and expensive, and it is the main reason model behavior differs so much between systems trained on similar web text.

Synthetic data

Synthetic data is generated by an AI model rather than collected from people. Microsoft Research demonstrated the approach publicly with phi-1, described in the 2023 paper "Textbooks Are All You Need" by Suriya Gunasekar and co-authors. They trained a 1.3 billion parameter code model on roughly six billion tokens of filtered web text plus one billion tokens of synthetic textbooks and exercises generated with GPT-3.5, and reached 50.6% pass@1 accuracy on the HumanEval benchmark, well above what a model that size would normally manage.

Synthetic data has an obvious appeal: it can be produced on demand and shaped to fill gaps. It also has a documented failure mode. In a 2024 paper in Nature, Ilia Shumailov and colleagues showed that indiscriminate use of model-generated content in training causes irreversible defects, in which the tails of the original content distribution disappear. They called this model collapse: each generation of model loses a little more of the rare and unusual material, and drifts toward bland averages. The finding does not make synthetic data useless. It makes it a supplement to human data rather than a replacement.

What happens to the data before training

Raw crawl data is close to unusable. Between collection and training sits a long cleaning stage, and its decisions shape the model as much as the sources do. Because a model does not file facts away but adjusts to patterns, which is how AI works, anything removed at this stage never becomes a pattern at all. The International AI Safety Report describes teams developing filtering methods to reduce harmful content, remove duplicates and improve representation across topics and sources, alongside work to reduce copyright and privacy problems and improve documentation of data provenance.

Those filters are not neutral, and researchers have checked. Jesse Dodge and co-authors documented the Colossal Clean Crawled Corpus in a 2021 EMNLP paper and found a significant amount of text from unexpected sources including patents and US military websites, machine-generated text from translation systems, and evaluation examples from other benchmark datasets sitting inside the training set. They also found that blocklist filtering disproportionately removed text from and about minority individuals, so a filter meant to strip offensive material quietly narrowed whose writing survived.

Why data quality matters more than raw volume

Stanford HAI states the principle plainly: the quality, quantity and diversity of training data largely determine how well an AI system will perform. Three specific problems follow from that.

Contamination undermines testing. When benchmark questions end up inside the training data, as Dodge's team found in C4, a high test score may reflect memorisation rather than capability. The International AI Safety Report notes that most developers do not currently track or disclose this.

Skew becomes behavior. The same report observes that most training data comes from Western sources, which contributes to uneven performance across languages and regions. A model is a compressed summary of what it read, so gaps in the reading become gaps in the answers. This is also where a data problem turns into a fairness problem, the subject of AI bias.

Errors propagate. Training data does not come with a truth flag attached, and a model has no mechanism for noticing that a confidently written falsehood is false. This is one of several reasons behind AI hallucinations.

What training data is not

Start with the confusion that comes up most: it is not what you type into a chatbot. When you send a message, you are not training the model. Its internal numbers were fixed when training ended. Your message goes into the context window, the working space the model reads for that conversation, and when the conversation ends that working space is gone. Nothing you wrote has changed how the model answers anyone else. That is a separate question from whether an assistant remembers you between sessions, which is a product feature rather than training and is covered in does AI remember.

Whether your conversation is later used to build a future model is different again, and it depends on the product. OpenAI's help documentation says that for its services for individuals, including ChatGPT, it may use your content to train its models, with an opt-out in settings, and that by default it does not train on inputs or outputs from business products including ChatGPT Business, ChatGPT Enterprise and the API. Defaults vary by provider, and what happens to what you type is the subject of is it safe to use AI.

There is a third thing that is neither training data nor your prompt: material the system fetches while answering. Retrieval-augmented generation was introduced in a 2020 paper by Patrick Lewis and colleagues, which distinguished between knowledge held in a model's parameters and a separate searchable index the model consults at the moment of answering. When an assistant cites a web page or quotes a document you uploaded, that content was retrieved, not learned. It is why an assistant can discuss this morning's news while its underlying knowledge cutoff sits months in the past. Anthropic's support documentation makes the same point about its own models: each one has a knowledge cutoff and may not be aware of events after that date. The mechanics are covered in how retrieval works.

Training data is also not a searchable index of its own. A trained model does not keep the pages it learned from in a form it can look up, which is why asking a model for its source often produces a plausible-looking citation rather than a real one.

Nor is it the customer data a company holds about you. Your account details, purchase history and support tickets sit in that company's systems under its privacy policy. Whether any of it is used for model training is a question about that policy, not about how models work.

And for most commercial models it is not disclosed. The public does not know the exact contents of the training set.

Who has to say what is in their data

That last point is beginning to change by law. Article 53(1)(d) of the EU AI Act requires providers of general-purpose AI models to "draw up and make publicly available a sufficiently detailed summary about the content used for training," following a template issued by the AI Office. It is a summary rather than a full inventory, but it is the first broad legal requirement for AI training data transparency.

Pressure is also coming from the other direction. The Data Provenance Initiative's 2024 study "Consent in Crisis" audited roughly 14,000 web domains across three major training corpora and found that in the year to April 2024, around 5 to 7% of tokens became restricted by robots.txt, rising to between 20 and 33% of tokens from the 2,000 most heavily used domains. Between 45 and 55% of tokens carried some form of restriction in a site's terms of service. Permission is being withdrawn quickly, and disproportionately from the sources models rely on most, which makes licensed and human-produced data more valuable and makes training data consent a live commercial issue rather than an abstract one.