Consent to train on user data: how to ask without tricking people

Asking permission to train models on user data needs a separate, clear and reversible decision. What European regulators say and how to design it.

info Quick Definition
Consent to train is an explicit authorization, separate from using the service, that lets a person’s data (their conversations, files or corrections) be used to improve or train AI models. It must be a decision the user can understand, refuse without losing the product and reverse.

What is the difference between using the service and training the model?

Using the service means the system processes your data to give you the answer you asked for. Training a model means that data is folded into a process that affects everyone who uses the model afterwards. These are different purposes, and regulation treats them as such.

If the user accepted “the terms”, they did not necessarily accept that their data trains a model. And if the product uses the same checkbox for both, consent is not valid in practice, even if it appears in a log.

What does European regulation say?

The European Data Protection Board (EDPB) adopted Opinion 28/2024 on 17 December 2024, at the request of the Irish data protection authority. Its main points, according to the text of the opinion and the Osborne Clarke summary:

  • Legitimate interest can serve as a legal basis for training and deploying models, but it is assessed case by case.
  • Controllers must consider the purposes for which models could be used later, including by third parties, and whether those uses would be illegal, unwanted or unfair.
  • People whose data is used for training must be able to object to the processing.
  • Transparency is a factor in the assessment.
  • If training was unlawful, the effect on later use of the model depends on the circumstances, including whether that later use involves only anonymized data.
  • Among the mitigating measures, the EDPB mentions offering an unconditional opt-out before processing starts, which goes beyond what Article 21 GDPR requires.

The opinion is not binding by itself, but European authorities usually treat it as a reference. For product decisions it works as a checklist: do we have a legal basis, does the person know what happens, can they object?

When the legal basis is consent, the GDPR adds very concrete design rules. Article 7 requires the request to be clearly distinguishable from other matters (paragraph 2), withdrawal to be as easy as giving consent (paragraph 3), and an assessment of whether the service is made conditional on processing that is not necessary to provide it (paragraph 4). Recital 32 states that silence, pre-ticked boxes and inactivity do not constitute consent.

How do you design a real decision?

A well-designed consent has four traits:

  1. Separate. Its own screen or block, not a line inside the terms.
  2. Off by default. If the option is pre-ticked, the decision is not the user’s.
  3. Plain language. It explains what is trained, with which data and what is excluded (for example, “your private files are not used”).
  4. Reversible. A visible setting to change your mind, with an honest explanation of what cannot be undone.

One thing users often misunderstand is irreversibility. If data was already used for training, withdrawing permission stops future uses, but it does not always erase the influence that data had on the model. Say so before people find out on their own.

There is a documented case that shows what to avoid. On 28 August 2025, Anthropic announced changes to its consumer terms: conversations and coding sessions from the Free, Pro and Max plans could be used to train models, with retention of up to five years if the person allowed it (compared with 30 days before). Commercial services and the API were excluded (Anthropic). Early reports gave a deadline of 28 September; Anthropic’s page now states 8 October 2025 as the date to make the choice.

According to Business Today’s report, the pop-up had a large “Accept” button and a much smaller training toggle that was on by default, which some critics said could lead people to consent without noticing (Business Today).

The pattern is clear: the big button approves everything, the small toggle decides about training, and the deadline pushes people to decide quickly. An honest design would separate the two decisions and leave training off. Today, Anthropic’s help center describes the control as the “Model Improvement” setting in privacy settings, and says incognito chats are not used for training (Anthropic).

How do other products handle it?

Google offers the “Keep Activity” setting in Gemini. With it on, chats are saved and used to improve Google services, including training models, and some are seen by human reviewers. With it off, new chats are not used for training unless you send feedback to Google, although they are kept for 72 hours to respond to you and protect users. Data that people already reviewed is kept for up to three years even if you delete your activity (Google).

The design lesson is in those details: a good opt-out says what changes when you switch it off, which exceptions remain (feedback, temporary retention) and what cannot be undone.

Example

Illustrative example: a sketching app with AI wants to improve its generator using its users’ drawings. Before the feature turns on, a separate screen appears with two columns: “What is used” (your prompts to generate an image, only in your account) and “What would be used for training” (your final drawings, without name or metadata). The toggle is off. If you turn it on, the text says you can change it in Settings and that drawings already used cannot be withdrawn from the model. A link opens the full policy.

How to apply it tomorrow

  1. Review your permission flow and separate each purpose into its own screen or block: using the service, improving the product and training third-party models.
  2. Confirm that the training option starts switched off and can be changed from Settings without searching.
  3. Write the option text with two lists: what is used and what is not used. If you cannot fill the second list, the text is not ready.
  4. Ask someone in legal or privacy to review the text before launch, and store the date and version of the screen each user accepted.

A quick test: if a new user takes more than thirty seconds to find how to say no, the consent needs a redesign.

To see how this becomes interface, read AI dark patterns, which describes designs that push people to accept. The notice at the moment of sharing connects with privacy and data in AI products, and explaining what the system does with each piece of data with explainability in AI products.

Common mistakes

  • Putting training inside “I accept the terms”.
  • Switching the permission on by default and hoping nobody changes it.
  • Hiding the option in a menu that only patient users find.
  • Asking consent to “improve the service” when what happens is training a third-party model.
  • Not explaining what happens to data already used when someone withdraws permission.
  • Using a short decision window to push people into accepting.

Sources

Frequently asked questions

What is consent to train an AI model on user data?
It is an explicit authorization, separate from using the service, that lets a person’s conversations, files or corrections be used to improve or train AI models. It must be possible to refuse it and to withdraw it as easily as it was given.
Can training be included in the terms of service?
Better not. If training sits inside a general acceptance, the user has no real decision. Separate it into its own reversible option.
What does the EDPB say about training models on personal data?
Opinion 28/2024, adopted on 17 December 2024, accepts legitimate interest as a legal basis with a case-by-case assessment, requires that people can object, and suggests an unconditional up-front opt-out as a mitigating measure.
What should happen when a user withdraws consent?
It should be clear what stops being used from that moment and what cannot be withdrawn, because data already used in training cannot always be removed from the model.