AI in the Art Market, Part 2: Dataland, Training Data and Data Rights

This is the second article in a three-part series. The first article, "Artificial Intelligence in the Art Market," was published on April 20, 2026.

The findings from the Artsy survey highlighted in a previous Holland & Knight article suggested that artificial intelligence (AI) is already embedded in the operational side of the art market, even as galleries, artists and collectors remain uncertain about AI's role as an artistic medium. Since the survey's publication, public debate has continued to shift into broader concerns about privacy, data governance and the rights associated with training datasets used by generative AI systems.

A recent Art Basel interview with Dataland co-founders illustrates that shift. Dataland is the first museum for AI-generated art, housed in downtown Los Angeles, with five galleries dedicated to its debut exhibition, "Machine Dreams: Rainforest." The emergence of Dataland – and the data-intensive systems behind its immersive experiences – signals that AI-driven art installations are raising new legal questions regarding data collection, biometric privacy, training data sourcing and vendor governance.

AI Museums, Immersive Experiences and Privacy Questions

The emergence of Dataland and other AI-focused immersive installations introduces new privacy and data governance issues. Art Basel's interview describes Dataland's behind-the-walls systems as reading visitors' emotions and notes that the inaugural exhibition is designed as a multisensory experience, with exhibits using biometric devices, physiological monitoring, environmental sensors or emotion-responsive systems.

Although these technologies can generate personalized digital experiences, they may also involve the collection and processing of information that falls within the scope of expanding state privacy and biometric privacy statutes, such as the Illinois Biometric Information Privacy Act (BIPA), California Consumer Privacy Act (CCPA) and other comparable laws. As further discussed below, proposed federal legislation such as the Nurture Originals, Foster Art, and Keep Entertainment Safe (NO FAKES) Act, Creative Rights Ensuring Artists' Technique and Originality Are Reserved (CREATOR) Act or Copyright Labeling and Ethical Reporting (CLEAR) Act may also become relevant to this analysis.

Organizations deploying interactive AI experiences should carefully evaluate:

• whether facial or iris recognition, voice prints, physiological data or emotion data qualifies as biometric or sensitive information under applicable law, noting that the definition varies across jurisdictions
• what notice, consent, transparency, retention and deletion obligations apply, including any opt-in or opt-out requirements
• data retention schedules and deletion obligations, including statutory timelines
• vendor and third-party data agreements, including contractual safeguards and data processing agreements
• whether the nature of the data triggers heightened cybersecurity controls, breach-notification duties, statutory damages or regulatory enforcement risk
• consumer-facing transparency measures, including whether privacy notices accurately describe the scope and purpose of data collection

Training Data and "Ethical AI"

In the art world, the "ethical" AI movement emphasizes licensed, institutionally sourced or independently collected datasets. For example, Dataland's co-founders told Art Basel that the project chose to focus on nature-focused datasets rather than human-generated information. The exhibit assembled ecological data "always with permission, and through formal partnerships," and built collaborations with museums and scientific and environmental organizations.

In this context, ethical AI initiatives appear designed, at least in part, to address concerns regarding copyright, consent and the use of artists' works in AI training. This is particularly salient given the more than 140 pending lawsuits regarding whether training generative AI models on copyrighted works (absent compensation, attribution or other consent) is a "fair use defense" to copyright infringement under 17 U.S.C. § 107.

At the same time, AI-driven art installations that collect biometric data, physiological information and other sensitive personal data present an expanded attack surface for data breaches and unauthorized access. Organizations deploying these systems may consider whether the data collected triggers heightened security requirements under applicable law, including breach notification obligations and sector-specific cybersecurity standards.

Proposed Federal Legislation: The NO FAKES, CREATOR and CLEAR Acts

Emerging legislative proposals may add another layer to this analysis. The CREATOR Act (H.R. 9112) would create a federal right, distinct from copyright and trademark, for visual artists or right holders to authorize the commercial exploitation or public distribution of AI-generated works that constitute deliberate stylistic impersonation. The CREATOR Act defines an "artist" as "a human individual who has created and publicly distributed or exhibited original visual works of authorship." Under the bill, liability would attach to output or distribution, not AI training data nor licensing an AI system. Though this U.S. House of Representatives bill is bipartisan, it is unlikely to advance in either the House Committee on the Judiciary or the full House this year, given the limited legislative days remaining in the U.S. Congress and in light of competing priorities on the legislative agenda. If that is the case, the bill will need to be reintroduced next year.  

Likewise, on the output side of AI, the proposed NO FAKES Act (S. 4591 and H.R. 8915) would create a federal cause of action for individuals to protect themselves against unauthorized digital replicas made by AI systems by giving all individuals (including artists) a licensable right to their name, image, likeness and voice. For museums, galleries, marketplaces and technology partners, digital-replica risk should be incorporated into the same governance framework as privacy compliance, training-data provenance, cybersecurity and vendor oversight. The NO FAKES Act has not yet advanced in the House, but it has been reported favorably by the U.S. Senate Committee on the Judiciary and now awaits floor action as a standalone measure or attachment to another moving legislative vehicle.

Two additional measures – the proposed CLEAR Act (S. 3813) and the proposed TRAIN Act (S. 2455 and H.R. 7209) – address training-data transparency when copyrighted works are used to train generative AI models. The CLEAR Act would require AI companies to submit notice to the U.S. Copyright Office disclosing the copyrighted works that were used to train their generative AI models. The CLEAR Act would not prohibit training on copyrighted content; however, it would make the disclosure a federal requirement. The CLEAR Act does not yet have a House companion, and it has not yet advanced this year in the Senate Judiciary Committee – the committee of jurisdiction. Taking a slightly different approach but not prohibiting training generative AI models on copyrighted content, the TRAIN Act would create an administrative subpoena process to assist copyright owners in determining which of their copyrighted works have been used in the training of AI models. The TRAIN Act does have a House companion, but neither measure has moved in their respective Judiciary Committees. 

Despite the unclear trajectory of these bills on the output and input sides of AI-generated content, they represent the issues and solutions Congress is considering regarding AI and art, which should be on the radar of stakeholders in the industry. It is anticipated that several – if not all – of these bills will be reintroduced in the next Congress in either a piecemeal fashion or as a part of more comprehensive AI and copyright legislation. Additionally, the outcome of the pending court cases noted above is anticipated to influence the congressional response and approach to AI and copyright.

Considerations for Clients

As AI becomes more visible within artistic and cultural spaces, organizations may consider expanding their governance frameworks beyond operational use cases to risks arising from data collection, privacy and training data, for example, by:

• auditing privacy, consent, transparency, retention and deletion practices for immersive, biometric or sensory-enabled experiences under BIPA, CCPA and comparable laws
• reviewing cybersecurity posture and vendor contracts for AI systems that process biometric or sensitive data, including ownership, security, breach notice and indemnity terms
• updating disclosures for AI-assisted works, exhibitions and marketing materials, and documenting permissions where outputs may emulate a specific artist or likeness
• evaluating training data provenance, licensing, written permissions and partnership records to reduce litigation risk and reputational exposure
• monitoring judicial, legislative and regulatory developments involving fair use, training data, privacy, identity rights and platform obligations, as well as ensuring compliance with updated legal and regulatory changes
• establishing vendor due diligence processes for AI systems deployed in public-facing cultural experiences, including contractual provisions addressing data processing, security, retention and deletion
• considering contractual safeguards before deployment, including data processing agreements, clear allocation of data ownership, security obligations, breach notification protocols and indemnification provisions

Conclusion

AI in the art market continues to evolve rapidly. Privacy obligations, intellectual property rights, training data litigation and regulatory scrutiny are converging to create a complex compliance environment for organizations operating in creative industries.

For legal and compliance teams, the most consequential risks may no longer arise solely from the technology itself, but from how data is collected, processed, stored and shared within increasingly immersive and AI-driven artistic environments. Organizations that proactively address privacy compliance, training data governance and cybersecurity safeguards will be better positioned to navigate both legal obligations and evolving market expectations as AI moves from administrative workflows into galleries, museums and artistic production.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.