The law does not care much what your model learns from a book; it cares intensely about how the book got onto your hard drive.
That distinction is the whole story, and it is the part that keeps getting flattened in summaries. Courts in the Northern District of California have now looked hard at AI training on copyrighted books, and the pattern emerging from Bartz v. Anthropic and Kadrey v. Meta Platforms is not a blanket permission slip. It is a split verdict with a very sharp seam running down the middle: the training itself has been treated as transformative fair use, while the acquisition of the training corpus is a separate act that can independently infringe.
In Bartz, the court denied summary judgment for Anthropic on its use of pirated copies to assemble a central library, but found that training AI on copyrighted works was itself protected. One federal court described that training as “quintessentially” transformative. And Judge William Alsup ordered Anthropic to pay a $1.5 billion copyright settlement to a group of writers whose works were used in training. Both of those facts are true at once. If that feels contradictory, it is because most people are collapsing two legally distinct operations into one word: “training.”
Two Pipelines, Two Legal Questions
From an engineering standpoint this decomposition is actually intuitive. Anyone who has built a data pipeline knows it has stages, and those stages have different properties. Consider what a training run actually involves:
- Acquisition — obtaining the source material, whether by purchase, license, scraping, or download from a shadow library.
- Retention — storing and organizing that material into a persistent corpus, indexed and reusable.
- Transformation — tokenizing, embedding, and using the text to adjust model weights.
- Output — what the trained system produces for users.
The transformative-use reasoning applies most cleanly to stage three. A model does not store the book; it stores statistical relationships derived from an enormous distribution of text. That is genuinely different from reproducing a novel. But stages one and two are ordinary copying, and copying is exactly what copyright law was built to regulate. Building a permanent library of pirated books is not made lawful because something clever happens downstream. The court’s willingness to bless the transformation did not launder the theft that preceded it.
Why This Matters for Agent Architecture
I work on agent systems, and this ruling pattern lands directly on how we should be designing them. Agents are increasingly the component doing acquisition. A retrieval agent that fetches documents, a crawler agent that expands its own corpus, a research agent that pulls full texts — each of those is making copies, and each of those copies has a provenance.
If the legal exposure sits at acquisition rather than transformation, then provenance tracking stops being a compliance nicety and becomes a core architectural requirement. That means:
- Every artifact in a corpus should carry its source and acquisition method as first-class metadata, not as a log line someone can grep for later.
- Retention policies need to distinguish between transient working copies and persistent libraries, because the courts appear to be doing exactly that.
- Autonomous data collection needs guardrails at the fetch layer, since an agent that decides on its own to download from a shadow library has created liability no amount of fine-tuning can undo.
The uncomfortable implication for anyone building agents that gather their own training data: you have handed the riskiest legal decision in your stack to a policy network. That is a design choice worth revisiting.
The Settlement Is the Signal
A $1.5 billion figure attached to a case where training was also held transformative tells you where the money is. Not in the abstract question of whether models may learn from books, but in the concrete, auditable question of where the files came from. Legal acquisition plus transformative use has found favor. Piracy plus transformative use has found a bill.
That framing should also temper the triumphalism I keep seeing in AI circles. “Training is fair use” is a real finding, and a meaningful one, but it is not a defense against the discovery process. Plaintiffs’ counsel now has a very clear roadmap: skip the philosophy of machine learning, go straight for the download logs.
What I Would Tell a Team Today
Treat your corpus like a supply chain, because that is how it will be examined. Know your suppliers, keep receipts, and assume that in litigation, provenance metadata will be more valuable than any explanation of how attention heads work. The technical argument for transformation appears to be holding. The paperwork argument is where cases are being lost.
These are recent decisions, appeals are ongoing across the space, and the reasoning will keep moving. Check current rulings before making architectural commitments on the strength of any single opinion, including this one. But the underlying principle looks durable, because it is not really about AI. It is the oldest rule in copyright, applied to a new kind of reader: what you do with the book is your business, and how you got it is everyone else’s.
🕒 Published: