AI, works, images, databases and secrets: what may be used
Being technically able to reach a piece of content does not mean being allowed to copy it, extract it, train on it or republish it. An AI agent must respect copyright, the database maker’s right, privacy, image rights, personal data, contracts and trade secrets alike.
Law verified as at 16 August 2026. This page is not individualised legal advice.
Content that is accessible online is not automatically free to reuse. The agent must respect copyright, the rights of the database maker, image rights, privacy and trade secrets. The text and data mining exceptions come with conditions of their own, including lawful access and, depending on the regime, the possibility of an opt-out. The origin of the content and the rights of use must be documented. Source: French Intellectual Property Code (code de la propriété intellectuelle) ↗(opens in a new tab).
Quotable legal markers
What you need to be able to cite
Protected work
Reproduction or communication to the public requires an authorisation, unless an applicable statutory exception applies.
A protected work may not be reproduced or communicated to the public without authorisation, save where a statutory exception applies.
Text and data mining is a tightly framed exception, not a general licence to scrape.
The maker of a database may prohibit the extraction or re-utilisation of a substantial part and certain repeated extractions of non-substantial parts.
A public image is not free to use. Copyright, privacy, image rights and the GDPR can apply together.
Trade secrets require secret information, commercial value and reasonableprotection measures. Unlawful acquisition or use can be penalised.
A provider of a general-purpose AI model has obligations of its own concerning the copyright compliance policy and the summary of the content used for training.
Our sources
Our official sources
Every statement on this page links to the text or decision it rests on. The links go straight to the official document.
Editorial author and publisher: Blue Lemon Agent, a brand of LINDBERGH FORMATION. Method: texts and decisions verified on EUR-Lex, Légifrance, the CNIL, the courts and the competent authorities. Legal review: Mohamadou Hamady DIA, juriste, on 18/08/2026. Updated on 10/09/2026.
content in the public domain, subject to moral rights and to other rights;
content under a licence compatible with the intended use;
content belonging to the organisation, within the scope of its rights;
content covered by a statutory exception all of whose conditions are satisfied;
information or an idea that is not protected as such, without taking over the original expression.
It must not reproduce long passages merely because they are accessible online, nor circumvent a paywall, nor confer on the client rights that the supplier of the corpus has not granted.
Text and data mining: an exception subject to conditions
scientific research, for certain research organisations and cultural heritage institutions having lawful access, with secure storage;
general mining, for any person having lawful access, unless the rightholder has reserved its rights in an appropriate manner — in particular by machine-readable means in the case of online content.
The Court makes clear that the investment giving rise to the sui generis right concerns the obtaining, verification and presentation of the contents, not the resources devoted to the creation of the data. It also defines extraction and re-utilisation, together with the quantitative or qualitative criteria of a substantial part.
CJEU, 9 November 2004, Fixtures Marketing, C-338/02
According to the CJEU, prohibiting extraction or re-utilisation requires, among other matters, an assessment of whether the acts create a risk to the possibility of recouping the investment in the database (CJEU, 3 June 2021, C-762/19, CV-Online Latvia ↗(opens in a new tab)).
Image rights, privacy and personal data
Under article 9 of the French Civil Code (code civil) ↗(opens in a new tab), respect for privacy is protected. Publishing the image of an identifiable person calls in principle for that person’s authorisation, subject to balances tied in particular to the legitimate information of the public, the place, the event and dignity. An image may also be personal data; facial recognition may involve sensitive biometric data.
Cour de cassation (France’s supreme court), First Civil Chamber, 20 February 2001, n° 98-23.471
Publication of the image of a person involved in a news event may be justified by the right to information, subject in particular to respect for dignity.
Cour de cassation, First Civil Chamber, 21 February 2006, n° 03-19.994
The publication, without authorisation, of an individualised image having no sufficient connection with the event relied on was not justified.
Lesson: the circumstances in which the image was captured and the purpose of publication must be checked image by image. A bank of pictures found on the web is not enough.
Under article L151-3 of the French Commercial Code (code de commerce) ↗(opens in a new tab), independent discovery or creation is recognised as lawful, as is the observation, study, disassembly or testing of a product made available to the public or lawfully held, unless the contract provides otherwise. Articles L151-4 and L151-5 define unlawful obtaining, use and disclosure. Articles L151-7 and L151-8 provide for exceptions, in particular the exercise of legal powers, freedom of expression and information, and the reporting of certain wrongdoing or unlawful activity.
For an agent connected to internal workspaces:
compartmentalise clients, projects and access rights;
prevent information belonging to one client from appearing in the answer given to another;
identify confidential documents and the rules governing their circulation;
comply with access and non-disclosure clauses;
do not automatically index every shared folder;
remove secrets from logs and test datasets.
Obligations of providers of general-purpose models
Under Article 53 of the AI Act ↗(opens in a new tab), providers of general-purpose AI models must put in place a policy to comply with Union copyright law, in particular in order to identify and comply with reservations of rights expressed pursuant to Article 4, paragraph 3, of Directive 2019/790, and must publish a sufficiently detailed summary of the content used for training, following the template provided by the AI Office.
These obligations fall on the provider of the model. They do not relieve the deployer of the need to check its own corpora, connectors, outputs and rights of use.
Integration checklist
To check before putting the agent into service
Inventory of corpora with owner, licence, source and purpose.
Lawful access and TDM reservations of rights checked.
Contracts, robots.txt files and technical measures complied with.
Extract length thresholds and quotation rules defined.
Outputs that prevent memorised passages from being reproduced.
Databases assessed under L342-1 and L342-2.
Consents or justifications documented for images.
Personal and biometric data processed in accordance with the GDPR.
Secrets classified and workspaces compartmentalised.
Takedown procedure and route for rightholders to object.
Frequently asked
What we get asked most
Can any public content be used to train an AI?
No. Public access neutralises neither copyright, nor reservations of rights as regards mining, nor database rights, the GDPR, contracts or trade secrets.
Does the mining exception permit republication?
No. It permits certain reproductions and extractions necessary for the analysis, subject to conditions; it does not automatically permit works to be circulated in the outputs.
Are a few lines from an article always free to use?
No. Brevity is not enough. The originality, the purpose, the short quotation exception and its conditions, including the source and the proportion, must be examined.
May small parts of a database be extracted?
An occasional, non-substantial extraction may be possible, but repeated and systematic extractions which exceed normal use may be prohibited.
May a photograph taken in the street be published?
Being in a public place does not make every publication free. The identification, the framing, the news context, the purpose and dignity must be examined.
May an employee upload a confidential document into the agent?
Only if the tool, the access rights, the contract, security and the purpose allow it. Ordinary professional access to the document does not authorise every transfer to an external supplier.
