A field guide to the AI training-data lawsuits that have actually produced rulings — Thomson Reuters v. Ross, Bartz v. Anthropic, Kadrey v. Meta, Getty v. Stability — and what they do and don't establish for anyone building on top of a foundation model.
Ask five people whether training an AI model on copyrighted text is legal and you'll get five confident, contradictory answers. That's not because the law is silent — several US courts have now ruled on the question directly — it's because the rulings are narrower and more fact-specific than the headlines suggest, and because "training is fair use" and "how you acquired the training data is fair use" turned out to be two separate questions with two different answers.
This is a map of what's actually been decided, what settled before a verdict, and what's still genuinely open. The short version: courts have been receptive to the transformative use argument for training itself, but increasingly unforgiving about how the data was obtained — and that distinction is now the fault line the rest of the litigation is being fought over.
US copyright's fair use test balances four factors, but two have dominated every AI ruling so far:
Courts have generally sided with defendants on factor one — training itself, when done on lawfully acquired text, looks like the kind of transformative, non-expressive use that fair use is designed to protect, similar in kind (if not scale) to search engine indexing or reverse engineering. Where cases have gone against AI companies, it's almost always been on a different axis entirely: how the copies were obtained in the first place, which courts treat as a separate, prior question from what was legally done with them afterward.
| Case | Court | Core claim | Status | Key holding |
|---|---|---|---|---|
| Thomson Reuters v. Ross Intelligence | D. Del. | Training a legal-research AI on Westlaw headnotes | Decided, Feb 2025 | Fair use rejected on summary judgment — Ross's output competed directly with Westlaw's core product |
| Bartz v. Anthropic | N.D. Cal. | Authors' claims over books used to train Claude | Settled, Sept 2025, after partial ruling | Training on lawfully purchased books was transformative fair use; training on pirated copies was not — Anthropic paid $1.5B to resolve the piracy claim |
| Kadrey v. Meta | N.D. Cal. | Authors' claims over Llama training data | Partial summary judgment for Meta, June 2025 | Fair use upheld for these specific plaintiffs, but the court explicitly declined to bless AI training generally, citing thin evidence of market harm in this record |
| Getty Images v. Stability AI | UK High Court | Image-generation training and output similarity | Decided, Nov 2025 | Most claims failed because training occurred outside the UK, outside the court's jurisdiction; a narrow trademark claim survived |
| NYT v. OpenAI / Microsoft | S.D.N.Y. | News-article training and verbatim regurgitation | Ongoing | No merits ruling yet; discovery fights over retained chat logs and memorization evidence have dominated so far |
| UMG et al. v. Suno / Udio | D. Mass. / S.D.N.Y. | Training AI music generators on copyrighted recordings | Ongoing, licensing talks reported alongside litigation | No ruling; labels are pursuing settlement-and-license deals in parallel with the suits |
A pattern worth naming: every case that has produced a fair-use ruling for the AI company involved lawfully acquired training data. Every case where the AI company lost or paid out involved some allegation of the data being pirated, scraped in violation of terms of service, or reproduced near-verbatim in outputs.
Judge William Alsup's ruling split the question in half in a way that's now shaping how every other court thinks about these cases. He held that training an LLM on legally purchased books — books Anthropic bought, scanned, and used to teach the model statistical patterns of language — was exactly the kind of transformative use fair use exists to protect. The model doesn't store or reproduce the books; it learns from them the way a human reader learns style and structure from reading widely.
But a meaningful chunk of Anthropic's training corpus came from pirated sources — bulk book datasets assembled from shadow libraries. Alsup was unambiguous that acquiring copies through piracy is a distinct legal violation from the training itself, and fair use doesn't retroactively launder how you got the copy. That's a crucial distinction: it means the ruling isn't really about AI at all. It's an ordinary copyright-infringement finding about piracy, wrapped around a novel and mostly-favorable fair use finding about training. Anthropic settled the piracy claim for $1.5 billion — reportedly around $3,000 per work across roughly 500,000 books — rather than litigate statutory damages that could have gone dramatically higher per-work.
The practical takeaway for anyone building on foundation models: provenance, not novelty, is where the legal risk concentrates. A model trained on licensed or lawfully acquired data has a real fair-use argument. A model trained on a pirated dump does not get to borrow that argument just because the underlying use case is the same.
Judge Vince Chhabria's ruling for Meta got reported as "AI training is fair use," which overstates it. Chhabria ruled for Meta specifically because the plaintiffs in front of him hadn't built a strong record on market dilution — they didn't show that Llama's outputs were displacing sales of their specific books. He was explicit in the opinion that a plaintiff with better evidence of market harm — for instance, showing a model can reproduce a distinctive author's style well enough to substitute for licensing that style — could win a similar case. This is why the music-generation suits against Suno and Udio are being watched closely: the market-substitution argument is much easier to make when the output is a song that sounds like a specific artist than when it's a paragraph of prose.
Getty's UK case against Stability AI mostly failed on a jurisdictional technicality rather than the merits: Stability's training occurred on servers outside the UK, and the court held it couldn't apply UK copyright law to conduct that happened elsewhere. A narrow trademark claim survived because Stable Diffusion's outputs sometimes reproduced a garbled version of the Getty Images watermark, which is a trademark issue, not a copyright one. Getty has parallel litigation running in Delaware against the same defendant, where US copyright law and jurisdiction over Stability's US operations make the outcome a genuinely open question — the UK result doesn't resolve it.
Three questions remain live across the pending cases, and they're the ones that will actually determine how much this area of law changes over the next few years:
None of this changes overnight for a developer calling a model API — you're not the one who trained it, and downstream users of a model aren't generally liable for how the underlying training data was sourced. But if you're fine-tuning on a scraped corpus, building a RAG pipeline over content you don't have rights to redistribute, or shipping a product that can reproduce large chunks of a specific copyrighted work on demand, the emerging case law gives you a concrete checklist rather than a vague worry: know where your training or retrieval data actually came from, prefer licensed or clearly-permissioned sources over bulk scrapes, and treat verbatim-reproduction risk in outputs as a distinct problem from training-data risk — because courts are now treating it as one too.
The headline "AI training is fair use" is true in the narrow, hard-won sense that a few well-lawyered defendants have established it for lawfully acquired data. It is not a blanket rule, it doesn't cover how you got the data, and the cases most likely to break the pattern — verbatim regurgitation, style substitution in music and art — are still working their way through the courts.