A missing license does not mean you may use the data freely. Licensing guidance says creative work is under exclusive copyright by default, so without a license you generally have no permission to use, modify or share it. Treat an unlicensed dataset as unresolved, and ask the owner or choose another source.
This is a general explainer, not legal advice. Whether a particular use is allowed depends on the data, the law where you operate, and the facts, so involve counsel for anything you ship.
What the default looks like
The licensing site Choose a License says creative works, including code, are under exclusive copyright by default. It adds that without a license nobody else can copy, distribute or modify the work without being at risk of takedowns or litigation. For users, it says that generally means you have no permission from the creators to use, modify or share it. It also notes that hosting on a platform which lets you view or fork a project does not grant those permissions.
That page speaks about software, but the principle that unlicensed creative work is protected by default is the reason a blank license field is a warning, not a green light. A dataset made of text, images or recordings is creative or personal data in many cases.
Why training makes it harder
Training copies data into your pipeline, into checkpoints and sometimes into outputs. A model can be shared, sold or deployed, so the question outlives the experiment. Teams also tend to learn licenses late, when a customer or auditor asks where the data came from and nobody can answer.
A decision guide
| What you find | What to do |
|---|---|
| Clear permissive license, noted on the dataset card | Record it and the version, then proceed |
| License with conditions, such as attribution or noncommercial | Check the conditions against your use, then record |
| No license stated | Pause, contact the owner, or pick another source |
| License differs between the card and the repository | Treat as unresolved until clarified |
| Data scraped from sites with their own terms | Review those terms and the law, with counsel |
What to record for each dataset
- Name, version and the exact place you obtained it.
- The license text or a link, with the date you checked it.
- Any conditions that affect your use, such as sharing or commercial restrictions.
- Who approved its use and why.
- Whether it holds personal data, which brings separate obligations.
Our posts on which license fields to record for a model and its datasets and what a dataset card is give a field list.
Make it routine
Add a dataset intake step, the same way you review a new dependency. No license, no training run until someone signs off. Safeguard's compliance and evidence automation can help keep records of reviews and approvals, and you can try a free scan of your code at gold.safeguard.sh/scan.
Quick check
Is public on the internet the same as free to use?
No. Being viewable does not grant permission to copy or use it.
Who should decide on an unclear license?
Someone with legal responsibility, using the owner's answer, not the engineer who wants to start the run.
Sources
Last reviewed: 19 October 2026.
