A company uploaded customer data to its AI vendor’s system for analysis.
Somewhere in the terms of service, it says, “We may use your data to improve our models.”
That means customer data is now training the vendor’s AI.
Competitors who use the same vendor benefit from insights derived from those customers.
And nobody got customer consent for AI training.
That’s a GDPR/CCPA violation waiting to happen.
What Most Companies Don’t Realize
Most vendor AI contracts allow training on customer data.
Companies don’t notice because the language is vague.
“We may use your data to improve our services.”
“Your inputs help us enhance our models.”
“Data may be used for quality assurance and optimization.”
This isn’t about storing data. It’s about using data to train AI models that serve everyone.
Customer information uploaded for one purpose gets repurposed for another without consent.
Why This Is a Privacy Problem
Customer consent for “processing” doesn’t equal consent for “AI training.”
When customers agree to the terms of service, they consent to their data being processed for the service they signed up for.
They didn’t consent to their data training AI models. They didn’t consent to their patterns and behaviors teaching algorithms. They didn’t consent to their information being used to improve services for other customers.
GDPR requires specific consent for specific purposes. “Improving our AI” is a different purpose than “providing you service.”
CCPA gives consumers the right to know how their data is used and to opt out of certain uses.
If companies are feeding customer data into AI training without explicit consent, they’re likely violating privacy laws.
The Competitive Intelligence Leak
There’s another problem most companies haven’t thought about.
When vendor AI trains on customer data, insights leak to competitors.
Company A uploads customer purchase patterns to a vendor AI for analysis. The AI learns from those patterns. Company B, a competitor, uses the same vendor AI. The AI’s recommendations to Company B are influenced by what it learned from Company A’s customers.
Company A just gave its competitor indirect access to its customer intelligence.
Not the raw data. But the patterns. The behaviors. The insights the AI extracted.
What “Improve Our Services” Actually Means
Vendors use vague language in terms of service.
“We may use your data to improve our services” sounds reasonable.
But what does it actually mean?
It means customer data gets added to training datasets. The AI learns patterns from that data. Those patterns influence how the AI responds to everyone else. The “improvement” benefits all customers, not just the company that provided the data.
If this were happening with a human service provider, it would be obvious. Imagine hiring a consultant who learns your business strategy, then uses that knowledge to advise your competitors. Companies would never agree to that.
But with AI, the same thing happens, and nobody notices because it’s automated and invisible.
The Questions Most Companies Never Asked
When companies signed up for AI vendor services, they probably didn’t ask:
“Will our customer data be used to train AI models?”
“If yes, which data specifically?”
“Will the trained models serve other customers, including our competitors?”
“Can we opt out of having our data used for training?”
“Can we audit what data has been used for training and delete it?”
Most companies assumed the vendor would keep their data confidential and use it only for their benefit.
That assumption is often wrong.
What the Contracts Actually Say
Most AI vendor contracts have clauses like this:
“Vendor may use Customer Data to develop, improve, and provide Services, including to train and improve Vendor’s AI models.”
Or:
“Customer grants Vendor a worldwide, royalty-free license to use, reproduce, and modify Customer Data for purposes of providing and improving Services.”
Or:
“Vendor may aggregate and anonymize Customer Data for analytics, product improvement, and model training purposes.”
These clauses give vendors broad rights to use customer data for AI training.
And most companies never negotiated them because they didn’t realize what they were agreeing to.
The Anonymization Excuse
Vendors often say, “We anonymize the data before training.”
That doesn’t solve the privacy problem.
GDPR applies to personal data, even if anonymized, if it can be re-identified. And AI models can sometimes leak training data or be reverse-engineered to reveal patterns about specific individuals.
More importantly, anonymization doesn’t solve the competitive intelligence problem. Even if individual customer identities are removed, the patterns and behaviors are still being learned by AI that serves competitors.
What Privacy Regulators Are Starting to Ask
Privacy regulators are catching up to AI training practices.
They’re asking companies:
“What data are you using to train AI?”
“Where did that data come from?”
“Did you get consent for AI training use?”
“Can individuals opt out of having their data used for training?”
“Can individuals request deletion of their data from training sets?”
Most companies can’t answer these questions because they don’t control the AI training. Their vendors do.
And when regulators ask vendors the same questions, the answers often reveal that customer data from multiple companies is mixed together in training sets with unclear consent and no easy way to delete specific data.
The Lawsuit Risk
Several lawsuits are already testing AI training data practices.
Publishers are suing AI companies for training on copyrighted content without permission.
Privacy class actions claiming AI companies used personal data for training without consent.
These lawsuits focus on the AI companies doing the training. But the next wave will target the companies that provided the data to AI vendors without getting proper consent from their customers.
“We didn’t know the vendor would train on our data” isn’t a defense when companies are responsible for protecting customer privacy.
What Companies Should Be Doing
Review vendor contracts for AI training clauses. Look for language about “improving services,” “model training,” “analytics,” or “product development.” These often mean training on customer data.
Ask vendors directly. “Are you training AI models on our customer data? If yes, which data? Will those models serve other customers?”
Negotiate opt-out rights. Demand contract clauses that say “Vendor will not use Customer Data for AI model training without prior written consent.”
Audit existing data use. For vendors already being used, ask what data has been used for training and whether it can be deleted from training sets.
Update customer consent. If planning to use customer data for AI training (directly or through vendors), get explicit consent. Don’t bury it in the general terms of service.
Consider data residency. For sensitive customer data, consider whether it should be uploaded to AI vendors at all, or whether AI should be run locally on company infrastructure.
The Contract Clauses That Actually Protect
Standard vendor contracts don’t protect customer data from AI training. Companies need specific clauses:
“Vendor will not use Customer Data for AI model training, product improvement, or any purpose other than providing Services to Customer without Customer’s prior written consent.”
“Any AI models trained on Customer Data will be exclusively for the Customer’s use and will not be used to serve other customers.”
“Customer may request deletion of Customer Data from any AI training datasets, and Vendor will complete such deletion within 30 days.”
“Vendor will provide annual attestation that Customer Data has not been used for unauthorized purposes, including AI model training.”
These clauses need to be negotiated. Vendors won’t offer them by default.
Ask This Question
Is customer data being uploaded to AI vendor systems right now?
If yes, check the contracts. What rights does the vendor have to use that data?
If the contract allows the vendor to “improve services” or “train models” using customer data, and customer consent wasn’t obtained for AI training, there’s a privacy compliance gap.
Schedule a 30-minute AI Data Use Assessment where we’ll:
- Review vendor contracts for AI training clauses
- Identify what customer data is at risk
- Show what contract terms actually protect data
- Help update customer consent for AI use
Because “we didn’t know our vendor was training on customer data” won’t protect companies when regulators or customers ask questions.
Find out now what’s happening with customer data. Before it becomes a privacy violation.
Brian Alexander
Founding Partner, VisionAI+ Consulting Group
Former General Counsel, AI Engineering Firm
Certified ISO 42001 Lead Auditor