Can terms of service stop someone from training AI on your product?
A ban on AI training is enforceable as a contract against users who actually agreed to your terms, which in practice means clickwrap acceptance. It gives you a breach-of-contract claim. It does not bind someone who never accepted the terms, and it does not by itself turn scraping into a violation of the Computer Fraud and Abuse Act. Treat it as one layer, alongside gated access, technical controls and registered rights.
1. Assent decides everything.
A contract binds the people who agreed to it. For online terms, courts ask whether the user had reasonably conspicuous notice of the terms and clearly showed assent. In Meyer v. Uber Technologies, Inc., 868 F.3d 66 (2d Cir. 2017), the court found a user bound where an uncluttered registration screen told him that creating an account meant agreeing to the hyperlinked terms.
The practical consequences:
- Use clickwrap. An unticked checkbox or a button beside a clear statement and a visible link to the terms. A link in the footer that nobody has to notice is the weakest form.
- Keep the record. Store who accepted, which version, and when. Without that you cannot prove the contract you want to enforce.
- Re-present material changes. If you add an AI training ban to existing terms, ask current users to accept the new version.
2. What a well-drafted clause covers.
Generic “no scraping” language was written for a different era. A current clause should address:
- The acts. Automated collection by any means, including crawlers, headless browsers, screen capture and autonomous agents; and using the product or its outputs to train, fine-tune, evaluate or benchmark a machine-learning model, or to build a dataset or embeddings.
- The material. The interface and its structure, API responses, generated outputs and documentation, not only “content”.
- Competitive use. Using access to build or improve a competing product.
- Who is responsible. The account holder, for anyone and any tool acting through the account.
- Consequences. Suspension and termination, written revocation of access, deletion of data taken and of anything derived from it, and an acknowledgment that an injunction may be appropriate.
Draft it so that it does not prohibit what you want to allow: accessibility tools, your customers’ own integrations, or search indexing of your public pages. Decide page by page. Most companies want their marketing site found by search engines and AI assistants, and their product closed to both.
3. What a ban does not reach.
People who never agreed
A notice on a public page is not acceptance. Someone who collects pages that anyone can view without logging in may never have formed a contract with you. Put what matters behind a login.
The Computer Fraud and Abuse Act, in most cases
Breaking your terms is not the same as accessing a computer without authorization under 18 U.S.C. § 1030. In Van Buren v. United States (U.S. 2021), the Supreme Court read the statute as asking whether a person was entitled to enter the part of the system at issue, not whether they misused access they had. In hiQ Labs v. LinkedIn (9th Cir. 2022), the court found serious questions about whether collecting publicly available pages is covered at all.
AI agents add a further question. In Amazon.com Services v. Perplexity AI, No. 26-1444 (9th Cir. Aug. 4, 2026), the court vacated a preliminary injunction against an AI shopping agent. It concluded that Amazon was unlikely to show that Perplexity had “accessed” its computers, because on those facts it was the user who accessed Amazon with the agent’s help. That ruling came at the preliminary injunction stage, turned on how that tool worked, and the case continues. It still shows the direction: the statute is being read narrowly, and a terms violation is a weak foundation for a CFAA claim.
Claims that only restate copyright
The Copyright Act preempts state-law rights that are equivalent to copyright (17 U.S.C. § 301). A contract claim that amounts to “you copied my content” may face that defense. Terms that govern access and use, such as account conditions, rate limits and restrictions on competitive use, stand on firmer ground.
Proof
You have to show who did it and what it cost you. Contract damages for scraping can be hard to quantify, which is why logging, planted markers and registered rights matter as much as the clause.
4. Technical signals are not contracts.
A robots.txt file, crawler directives and rate limits are requests and obstacles, not agreements. A crawler that ignores them has not breached a contract by doing so. They are still worth using: reputable crawlers follow them, and they are evidence of what you did and did not permit.
5. A short checklist.
Tick the boxes as you review, or print this guide. Selections are not submitted. A checked box means the item has been addressed in your process, not that a legal conclusion has been established.
One related point runs the other way. If your own engineers use AI tools, check those vendors’ terms for confidentiality and no-training commitments. See the trade secret section of AI software cloning defense.
Common questions.
Can terms of service legally prohibit AI training?
Yes, as a matter of contract. A user who accepted terms that prohibit AI training and then breaks them has breached a contract. The prohibition does not bind people who never agreed to the terms.
Does a robots.txt file stop AI training?
No. A robots.txt file is a request to crawlers, not a contract or a technical barrier. Reputable crawlers follow it and it is useful evidence of what you permitted, but it does not by itself create a legal claim.
Is scraping my site a violation of the Computer Fraud and Abuse Act?
Often not. Courts have read the statute narrowly: a terms-of-service violation alone generally does not make access unauthorized, and courts have questioned whether collecting pages open to the public is covered at all. Access to gated areas after authorization has been revoked is a stronger case.
Do AI agents acting for my users have to follow my terms?
Your terms bind your user, who is responsible for the tools they direct. Whether the agent’s developer is also liable is unsettled. In Amazon.com Services v. Perplexity AI (9th Cir. Aug. 4, 2026), a preliminary-stage ruling, the court treated the user, not the agent’s maker, as the one accessing the site.