There is no button that removes your work from an AI training set, and anyone who tells you otherwise is selling something. What exists instead is a patchwork: a handful of web standards that well-behaved crawlers respect, a legal framework in Europe that gives those standards real weight, a fair-use fight in America that is going differently every few months, and a layer of evidence-building that will matter if you ever have to prove what you said and when. This is what creators can actually do in October 2026, what the courts are deciding, and where IP Vault fits — and where it does not.

Reporting current as of 8 October 2026. Several cases mentioned below are still moving; where a ruling is under appeal, we say so.

The short version

Three things are true at once, and most of the confusion in this area comes from mixing them up.

  • Telling crawlers no works, partly. The major AI developers say they honour robots.txt for their declared training bots. Undeclared crawlers, dataset middlemen and snapshots taken before you opted out do not care.
  • The law is on your side more in Europe than anywhere else — but only if you said no in the right way. The EU framework turns on a machine-readable reservation published where the content lives. A reservation tucked inside a private document does not obviously meet that test.
  • Proof is not prevention. Hashes, timestamps and signed declarations do not stop a single scrape. They make a later dispute easier to win. That is a real benefit, but it is a different benefit.

Step one: make your “no” unmistakable, and put it on your own site

The foundation of the European position is Article 4 of the 2019 Copyright in the Digital Single Market Directive. It lets anyone mine publicly available content for any purpose unless the rightholder has reserved their rights “in an appropriate manner, such as machine-readable means” for content published online. The EU AI Act (Article 53(1)(c)) then requires providers of general-purpose AI models to have a policy to identify and respect those reservations, and the AI Office’s Code of Practice, published in July 2025, names the Robots Exclusion Protocol (RFC 9309, the standard behind robots.txt) as the baseline signal providers should honour.

In practice, security and legal researchers recommend saying it several ways at once:

  • A robots.txt file that disallows the named AI training crawlers (GPTBot, ClaudeBot, Google-Extended, Applebot-Extended, CCBot and others). Some, such as Google-Extended and Applebot-Extended, control AI training without affecting search rankings.
  • The W3C community group’s TDM Reservation Protocol (TDMRep): a small file at /.well-known/tdmrep.json and a matching HTTP header, designed specifically for the EU exception. It is a community-group report, not a formal W3C standard, and we know of no published measurement showing that major AI crawlers read it.
  • The IETF’s AI Preferences work, which would let sites send a header such as Content-Usage: train-ai=n. As of this week the two core documents are still Internet-Drafts, not finished standards.
  • A plain-language reservation in your terms of service and copyright page. Courts have not settled whether this counts as machine-readable (more on that below), but it costs nothing.
  • Rights metadata embedded in the files themselves, such as the IPTC/PLUS “DataMining” field. Platforms routinely strip it on upload.

The 404 trap

One detail deserves more attention than it gets. Under RFC 9309, if a crawler requests your robots.txt and gets a “not found” (any 4xx error), it is allowed to crawl everything. A broken website migration, a lapsed domain or a misconfigured CDN does not leave your opt-out in a weakened state; it turns it into an opt-in. Creators who self-host should serve the file statically, set the domain to auto-renew for years, and monitor the file for any change or error.

If you publish on a platform, you may not control any of this

One study of artists’ practices found that many creators cannot edit robots.txt at all because they publish on someone else’s platform. Some platforms offer a toggle; others license your uploads for training under their terms. The practical workaround is to publish the full-quality original on a site you control and put reduced-resolution versions elsewhere, with a link back. Check each platform’s current AI settings rather than trusting a year-old guide, including this one.

Who actually listens?

Opt-outs are spreading quickly. A large audit by the Data Provenance Initiative found that in a single year (2023 to 2024), roughly a quarter of the most heavily used web sources in popular training datasets had added restrictions in robots.txt or terms of service. Compliance is a different question.

  • Declared bots mostly comply. OpenAI, Anthropic, Google, Apple and Common Crawl all publish documentation saying their training crawlers follow robots.txt. ByteDance’s Bytespider is widely reported not to.
  • Undeclared and stealth crawling is a live dispute. In August 2025 Cloudflare accused Perplexity of disguising its crawler to get around blocks; Perplexity disputed the claim. Separately, industry measurement firm TollBit has reported a rising share of AI bot visits ignoring robots.txt during 2025.
  • It is not retroactive. Blocking a crawler today does not remove your work from archives gathered years ago, and those archives feed many downstream datasets.
  • Middlemen change the picture. Several developers have been sued over datasets they downloaded from third parties or shadow libraries rather than crawled themselves. A robots.txt file means nothing to a company that never visited your site.

The stronger enforcement tools sit at the server or network edge: blocking known AI user agents, using a CDN’s AI-crawler controls, or putting proof-of-work challenges in front of heavily scraped archives. These work well against declared and naive bots and poorly against crawlers using residential proxies.

The registries that did not last

For a while, the obvious answer was a central opt-out list. Spawning’s “Do Not Train” registry was the best known, and some image-model developers said they would honour it. As of this week, both spawning.ai and haveibeentrained.com display a “maintenance” notice, and Spawning asks AI developers who want to respect the registry to get in touch directly. We could not confirm whether it has been formally shut down, but a registry that is not reliably reachable is a registry that cannot protect anyone.

The problem was never only Spawning. When a dataset builder queries a registry that is down, the path of least resistance is to keep the data. A registry entry is also not a reservation published “at the location” of your content, which is what the EU framework looks for. And even official infrastructure is not permanent: the World Intellectual Property Organization’s own digital timestamping service, WIPO PROOF, has been discontinued, though WIPO says tokens already issued remain valid. The lesson researchers draw is that any proof you rely on should be self-contained, so that it can be checked without the company that issued it still being around.

Poison, cloak or perturb? The tools that promised more than they delivered

Glaze and Nightshade, from researchers at the University of Chicago, add subtle changes to images so that models trained on them learn the wrong style or concept. They were a welcome expression of creator frustration, and they may deter casual style mimicry. But as protection they are weaker than their reputation. A peer-reviewed study presented at ICLR 2025 found that simple techniques such as noisy upscaling restored the ability to mimic protected artists, and a separate team presented a tool called LightShed at USENIX Security 2025 that detects and strips these perturbations. Treat them as friction, not a lock. There is no mature equivalent for writers.

Proof, not prevention

If you cannot reliably stop a copy, the next question is what you can show afterwards. Cryptographic evidence answers three narrow questions well:

  1. What was the file? A SHA-256 hash is a fingerprint. Change one bit and it no longer matches.
  2. When did it exist? A trusted timestamp binds that fingerprint to a point in time. Two kinds are in common use: an RFC 3161 timestamp from a trust-service provider (in the EU, a qualified one carries a statutory presumption of accuracy under the eIDAS Regulation, Article 41(2)) and an OpenTimestamps proof anchored to the Bitcoin blockchain, which depends on no company. Specialists recommend using both.
  3. When did you say no? This is the one most creators overlook. In the European cases, nobody argued about when the photograph was taken. The fight was over which exception applied and whether a valid reservation was in place when the copying happened. Dated evidence of your reservation can matter more than dated evidence of your work.

The limits are just as important. A hash proves a file existed, not who made it; a plagiarist can hash your work too. It only matches an exact copy, so a cropped or re-encoded image will not match. Courts are still catching up: a French court in Marseille accepted a blockchain timestamp as proof of prior creation in March 2025, but that was a first-instance ruling, and commentary on it suggests it was treated as the start of written evidence rather than conclusive proof. And in the United States, timestamps do not replace registration, which is the next thing to understand.

For a fuller treatment, see our earlier articles on how cryptographic hashing performs in court and why the “poor man’s copyright” never worked.

The courts and lawmakers: a moving target

Germany and the EU: “machine-readable” is the battleground

The most closely watched European case is Kneschke v. LAION. A photographer sued the German non-profit behind a large image dataset. In September 2024 the Hamburg Regional Court dismissed the claim, holding that the copying fell under the scientific-research exception. In passing, the judges said a reservation written in natural language in a website’s terms might count as machine-readable, given what modern AI can read.

On 10 December 2025 the Hamburg Higher Regional Court upheld the result. It treated the download as covered by the text-and-data-mining exceptions and found that the reservation in question was not machine-readable in the legally required form. According to commentary on the judgment, it did not rule natural-language reservations out in principle, but it indicated that the rightholder must show that tools in common use at the time could have detected and interpreted the reservation. The photographer failed on that point. The court allowed an appeal to the Federal Court of Justice (case I ZR 281/25), which heard it on 3 September 2026. No judgment was handed down and no date for one was announced. According to a press release from the law firm that represented LAION in the lower courts, the presiding judge said that some of the questions could be referred to the European Court of Justice. The panel asked whether a reservation in natural language can ever be enough, and whether “machine-readable” also means that a program must be able to understand it; it said programs must be able to understand the text if the system is to work, while stressing that its views were preliminary. It also sounded more guarded than the lower courts about whether LAION could rely on the research exception. Treat the account of the hearing as one side’s summary until the court publishes its own.

The takeaway for creators is uncomfortable but clear: “I wrote it in my terms” is a gamble. A standard, machine-readable signal on your own site is the safer way to say no.

A second German decision shifts the question from the front door to the finished model. In November 2025 the Munich Regional Court held, in GEMA v. OpenAI, that memorising song lyrics in a model and reproducing them infringed copyright, and that the mining exceptions did not cover that. OpenAI has appealed. On 31 July 2026 the same chamber ruled against the AI music service Suno in a second case brought by GEMA (42 O 763/25). According to GEMA, the court found that training on GEMA’s repertoire in the United States, and storing and reproducing it in Europe, infringed both US and German copyright law, and that GEMA could sue in Munich even though the training happened abroad. That judgment is not yet final. If courts increasingly ask what a model contains rather than only how it was fed, evidence that links your specific work to a specific model becomes more valuable.

Meanwhile, the regulatory clock has started. The AI Act’s obligations for general-purpose models applied from August 2025, and the AI Office’s enforcement powers began on 2 August 2026. The “Digital Omnibus” simplification package delayed rules for high-risk systems but, as far as we can tell, did not postpone these. Models already on the market before August 2025 have until August 2027. OpenAI, Anthropic, Google, Microsoft, Amazon and Mistral are among the signatories to the Code of Practice; Meta does not appear on the list, and xAI signed only the safety chapter. We have found no enforcement action yet.

Brussels is also reconsidering the underlying rules. The European Parliament adopted a non-binding resolution in March 2026 (the Voss report, passed 460 to 71) calling for clarification of the mining exception. In July 2026 the Commission also published a feasibility study on an EU-level registry where rightholders could record their text-and-data-mining opt-outs, using work-level identifiers and content fingerprinting. Its conclusion was measured: such a registry “could be a useful complementary instrument” that would sit alongside, not replace, existing signals, and the Commission says only that it will consider next steps. Unlike a private list, a public registry would at least have a legal basis behind it, but it is a study, not a proposal, and nothing like it exists today. A legal roundup also reports a Commission consultation on a possible copyright and AI initiative, closing on 3 November 2026. And a case before the Court of Justice, Like Company v. Google, is still pending. None of this is law yet.

The United Kingdom: a retreat from the opt-out

The UK has no commercial text-and-data-mining exception, only one for non-commercial research. In late 2024 the government floated adding a commercial exception with an opt-out for rightholders, and met a fierce backlash from the creative industries. The report required by the Data (Use and Access) Act 2025 was published on 18 March 2026. It says a broad exception with an opt-out is “no longer the preferred way forward”, proposes no new licensing intervention, and says the government will not reform copyright law until it is confident of the outcome. Law-firm commentary reads this as no new legislation for now. A private member’s bill on AI crawler transparency has been introduced, but it is not government policy.

In Getty Images v. Stability AI, the High Court ruled in November 2025 that the model’s weights were not an “infringing copy”, defeating the secondary-infringement claim; the training claims had been dropped because the training did not take place in the UK. Getty has been given permission to appeal on that point, and the Court of Appeal hearing is reportedly listed for early November.

The United States: fair use is being decided case by case

In the US, there is no opt-out regime. The question is whether training is fair use, and the answers so far depend heavily on the facts.

  • Bartz v. Anthropic and Kadrey v. Meta (June 2025). Two federal judges in California found for the developers on training with lawfully obtained books, while stressing that building a library from pirate sites was a different matter and that harm to the market for the originals could change the outcome on a better record. Anthropic settled the piracy claims for $1.5 billion. The court granted final approval on 20 July 2026, with payments of roughly $3,000 per work expected from November. The class was limited to works with timely copyright registrations. In Kadrey, the judge refused to let the authors appeal early; claims over how Meta distributed the books continue.
  • Thomson Reuters v. Ross Intelligence. On 29 September 2026 the Third Circuit upheld the finding that a non-generative AI competitor’s use was not fair use. The court distinguished generative-AI cases, and Ross has said it will ask the Supreme Court to review.
  • The New York Times v. OpenAI and Microsoft. Summary-judgment briefing began in September 2026 and runs into late November; there is no fair-use ruling. On 1 September the Department of Justice filed a statement of interest in the consolidated cases arguing that training on written works is “exceedingly transformative” and that the “market dilution” theory is deeply flawed. The news plaintiffs have asked the court to give it little weight. It is a notable signal of how contested the question is, not a ruling.
  • Copyright management information. Some creators hoped that stripped metadata would give them a route through section 1202 of the DMCA. On 16 September 2026 the Ninth Circuit, in Doe v. GitHub, affirmed dismissal of that claim as it applied to AI outputs, which narrows that route. We relied on case-tracker summaries here and have not read the opinion.

For American creators, one thing is not in doubt: registration still decides who gets to sue and what they can recover. You generally need a registration from the Copyright Office before filing an infringement suit, and statutory damages and attorney’s fees are available only if you registered before the infringement or within three months of publication. The Bartz settlement paid registered works and not others. Cryptographic timestamps are no substitute for this, whatever anyone selling them might suggest. The Copyright Office’s own report on generative-AI training, still labelled pre-publication, concluded that some training uses will be fair and others will not.

Elsewhere

Japan’s law allows most training unless it “unreasonably prejudices” the rightholder; Singapore’s computational-analysis exception has no opt-out at all. If your audience, your host or your work crosses borders, the rules that apply to you may be less favourable than the ones you have been reading about.

What IP Vault can do, and what it cannot

This is the section we would want to read if we were a creator deciding where to spend time and money, so we will be plain about it.

What it does

  • Records a declared reservation of rights, on by default. When you protect a work, IP Vault generates a copyright declaration (00_COPYRIGHT_DECLARATION.pdf). Unless you untick the option, it includes an express reservation of text-and-data-mining and AI-training rights under Article 4(3) of the DSM Directive, and states your expectation that general-purpose AI providers will respect it under Article 53(1)(c) of the AI Act. You can instead choose to permit AI training, and the declaration will say so.
  • Fingerprints your files. Every file is hashed with SHA-256, and the hashes are listed in a manifest inside your protected archive.
  • Dates the whole package twice. The archive, including the declaration and the manifest, is hashed and sealed with an eIDAS qualified timestamp (RFC 3161, issued through Lleida.net) and a Bitcoin OpenTimestamps anchor. You receive the proof files (.tsr and .ots) and can verify them without IP Vault. That is the dual-anchor approach researchers recommend, and it means the date of your reservation does not rest on our word.
  • Refuses to half-seal. If either timestamp service is unavailable, the run stops, no protection record is issued, and no tokens are deducted.
  • Does not keep your media long-term. Under the platform’s zero-server-storage design, the archive is available for you to download for a short window and is sent to your connected cloud drive if you have one, rather than being kept on our servers; the hashes, manifest and proofs are retained. If a timestamp service is down mid-run, the package is held for up to 24 hours so you can retry.

What that buys you is evidence. If a dispute ever turns on whether you had reserved your rights before a particular date, or on exactly which version of a work you held, you have independent, verifiable proof of both that does not depend on IP Vault surviving. In the EU, the qualified timestamp carries a statutory presumption about the date and integrity of the data. Elsewhere it is admissible evidence without that presumption. A hash match can also help show that a copy found in a dataset is bit-for-bit identical to the one you sealed.

What it does not do

  • It does not publish a reservation where crawlers or AI providers can find it. The reservation lives inside a sealed archive and a PDF. No crawler reads it. The EU framework looks for a machine-readable signal at the location of the content; we are not aware of any court that has treated a private, sealed declaration as one. Do not assume it satisfies Article 4(3) on its own.
  • It does not touch your website. IP Vault does not create or monitor your robots.txt, TDMRep file or HTTP headers, and does not snapshot or timestamp them. You need to do those things yourself, or use a host that does.
  • It contacts no registry and no AI company. Nothing is submitted to Spawning or anyone else. We removed our registry integration because the service it relied on is not working.
  • It does not stop, detect or block scraping. There is no crawler blocking, no monitoring for use of your work, and no canary or trap mechanism for proving ingestion.
  • It does not change your files. No embedded metadata, C2PA credentials, watermarks or adversarial perturbations are added.
  • It does not replace copyright registration. For US creators in particular, that remains the step that preserves your right to sue and to claim statutory damages.
  • It does not verify that you are the author. The declaration records your statement of authorship and the time you made it. It is not a determination or endorsement of ownership by IP Vault, and a timestamp alone proves possession, not authorship.
  • Your files do pass through our servers. Packaging and hashing happen on the platform, not only in your browser. They are not kept as a permanent archive, but you should think of the process as uploading your files for packaging, not as hashing them privately on your own device.
In short: IP Vault is an evidence tool. It helps you prove what you made, when you made it, and that you reserved your rights at that time. It is not an enforcement tool, and it is not a substitute for the web-level signals that AI developers are told to look for.

A sensible order of operations

If you have a few hours rather than a few weeks, this is the order we would suggest:

  1. Say no where it can be read. If you control a website, publish robots.txt rules for AI training crawlers, add a TDMRep file and header, and put a plain-language reservation in your terms. Use a static file and a long-lived domain, and set up an alert for errors.
  2. Enforce it. Block known AI crawlers at your server or CDN. Treat this as the layer that stops compliant and careless bots, not determined ones.
  3. Review each platform you publish on. Switch off AI training where the platform lets you, keep screenshots of the setting, and assume a platform without such a setting may license your uploads.
  4. Seal your work. Hash and timestamp finished work and, ideally, drafts before publication, with a dated reservation of rights. This is where a service like IP Vault belongs.
  5. Keep dated records of your opt-outs. Save copies of your robots.txt, terms and headers regularly and timestamp them. This is the evidence that your reservation was live on a given day, and it is not something IP Vault does for you today.
  6. Register where registration matters. In the US, that means the Copyright Office, ideally before or soon after publication, using group options where they apply.
  7. Revisit it every few months. The cases above will move, standards will change, and crawler names will multiply.

The bottom line

The honest position for a creator in late 2026 is that you can raise the cost of using your work without permission and improve your chances if it comes to a fight, but you cannot guarantee that your work stays out of training. The legal tide in Europe and the UK is more favourable than it was two years ago, and in the US it is unsettled and fact-specific. The reliable parts are the unglamorous ones: say no in a form machines can read, keep your own domain in order, hold dated evidence of both your work and your reservation, and register where the law makes registration the price of admission.

IP Vault covers part of that picture, the dated, verifiable evidence part, and it is better to know exactly which part before you rely on it.

Sources & further reading

  • Directive (EU) 2019/790, Articles 3 and 4 — eur-lex.europa.eu
  • Regulation (EU) 2024/1689 (AI Act), Article 53 — eur-lex.europa.eu
  • European Commission, General-Purpose AI Code of Practice and signatory list — digital-strategy.ec.europa.eu
  • RFC 9309, Robots Exclusion Protocol, section 2.3.1 — rfc-editor.org
  • IETF AI Preferences working group — datatracker.ietf.org
  • Regulation (EU) No 910/2014 (eIDAS), Article 41 — eur-lex.europa.eu
  • OLG Hamburg press office on Kneschke v. LAION (appeal dismissed, 10 December 2025) — justiz.hamburg.de
  • Harte-Bavendamm, analysis of the OLG Hamburg ruling — harte-bavendamm.de
  • UK Government, Report on Copyright and Artificial Intelligence (18 March 2026) — gov.uk
  • Getty Images v Stability AI [2025] EWHC 2863 (Ch); Mishcon de Reya generative-AI case tracker — mishcon.com
  • U.S. Copyright Office, Copyright and Artificial Intelligence, Part 3: Generative AI Training (pre-publication) — copyright.gov
  • European Commission, feasibility study on an EU-level registry of TDM opt-outs (13 July 2026) — digital-strategy.ec.europa.eu
  • Heidrich Rechtsanwälte, press releases on Kneschke v. LAION, including the BGH hearing of 3 September 2026 (the firm represented LAION in the lower courts) — recht-im-internet.de
  • GEMA, press release on the GEMA v. Suno judgment (31 July 2026) — gema.de
  • U.S. Department of Justice, Statement of Interest, In re OpenAI Copyright Infringement Litigation, MDL No. 3143 (1 September 2026) — courtlistener.com
  • Bartz v. Anthropic settlement administrator — anthropiccopyrightsettlement.com
  • Case-by-case tracking of US AI copyright rulings — chatgptiseatingtheworld.com
  • Longpre et al., Consent in Crisis: The Rapid Decline of the AI Data Commons (NeurIPS Datasets & Benchmarks, 2024)
  • Hönig, Rando, Carlini & Tramèr, Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI (ICLR 2025) — arxiv.org
  • Cloudflare, “Perplexity is using stealth, undeclared crawlers to evade website no-crawl directives” (August 2025)
  • WIPO PROOF (discontinued) — wipo.int
  • Tribunal judiciaire de Marseille, 20 March 2025 (blockchain timestamp as evidence of anteriority) — village-justice.com