There are a dozen licences you will meet repeatedly and only two clauses that cause most of the difficulty. Learning to spot those two is most of what you need.
The two clauses that matter
Most licence confusion dissolves once you look for these specifically rather than trying to memorise whole licences.
NC — non-commercial. Rules the dataset out of anything commercial. Unambiguous in intent and awkward at the edges: a startup's research prototype, an academic spinout, a commercial entity's internal tool. If you are building a product, treat NC as a stop sign rather than a question.
SA — share-alike. Requires derivative works you share to be licensed on the same terms. The critical uncertainty is whether a trained model counts as a derivative of its training data, which is not settled. If it does, sharing a model trained on share-alike data could oblige you to license it on the same terms. Many organisations avoid SA data in commercial work purely to avoid depending on the answer.
Everything else — attribution, notice requirements, disclaimers — is administratively cheap. Keep a record of what you trained on and you have satisfied it.
The licences you will actually meet
Roughly in order of permissiveness.
| Licence | Commercial use | Obligation | Watch for |
|---|---|---|---|
| CC0 / public domain | yes | none | content rights, privacy, trademark |
| MIT | yes | keep the notice | written for code, applied to data |
| Apache 2.0 | yes | keep the notice, state changes | patent grant is a plus |
| ODC-By | yes | attribution | purpose-built for databases |
| CC-BY 4.0 | yes | attribution | none significant |
| CC-BY-SA | yes | attribution and share-alike | a model you share may need the same licence |
| CC-BY-NC | no | attribution | research only in practice |
| CC-BY-NC-SA | no | attribution, share-alike | most restrictive common pair |
| CC-BY-NC-ND | no | plus no derivatives | training may be a derivative |
| Research-only / bespoke | usually no | read the agreement | signed DUA, terms often not public |
| Not stated | unknown | unknown | absence of a grant, not a grant |
Code licences on data, and why it is slightly odd
MIT and Apache 2.0 were written for software, and you will see them on datasets constantly. In practice this works — the intent is clearly permissive and nobody has made trouble about it — but the fit is imperfect, because the things a software licence grants are not quite the rights that attach to a compiled dataset.
ODC-By and the Open Data Commons family were written for databases specifically, which is why you see them on the large text corpora. If you are publishing a dataset, they are the better technical fit; if you are consuming one under MIT or Apache, the permissive intent is clear enough that this is not a practical problem.
Apache 2.0 has one genuine advantage worth knowing: it includes an express patent grant. For data that is rarely relevant, and for an accompanying toolchain it occasionally is.
“Not stated” is the case people misread
A surprising number of datasets, including well-known ones, state no licence at all. The Pile's code is MIT with no licence given for the data. Several robotics and video corpora publish papers with no dataset licence. Our verified inventory includes entries whose licence field reads, verbatim, “Unknown license (use to be verified)” and “Free download, license not explicitly specified”.
Freely accessible is not freely licensed. An unstated licence is the absence of a grant, not an implicit permissive one, and “it was on the internet” has never been a licence.
The practical options are to contact the publisher and ask, which works more often than people expect; to accept the risk explicitly as a documented decision rather than an assumption; or to use something else. For anything commercial, the third is usually cheapest. We kept the vague wording verbatim in Dataset Finder precisely because normalising it to a tidy identifier would have hidden information you need.
Licences stack
Your model's permissible uses are the intersection of several licences, and people routinely check only one.
The base model's licence. Every training dataset's licence. And if any of your data was generated by another model, that model's terms of service — several explicitly prohibit using outputs to train competing models, and a permissive licence on the resulting dataset does not clear that restriction.
All of them have to permit what you intend. Any one can be the blocker, and the one people miss is usually the third. Check the intersection before training, record what you checked, and the question becomes answerable later instead of alarming.
Questions people ask
Is a model trained on share-alike data a derivative work?
Unsettled, and jurisdiction-dependent. Arguments exist both ways and there is no reliable answer to give you. That uncertainty is itself the practical point: many organisations avoid share-alike training data in commercial work specifically so they never need the answer. This is a question for a lawyer, not for a blog.
Can I use non-commercial data for research in a company?
Genuinely ambiguous, and it depends on the licence's wording and your activity. Research that feeds a commercial product looks commercial; pure publication looks less so. Get advice rather than a rule of thumb — this is one of the most commonly rationalised decisions in machine learning.
What if a dataset's licence changed after I trained on it?
Keep dated records of the licence as it stood when you used it, including a copy of the text. That is your evidence of good faith and it costs nothing to collect at the time. It is impossible to reconstruct afterwards, which is why provenance records are worth keeping as a habit rather than a project.
Does attribution mean I have to credit every dataset publicly?
Typically you must give credit in a manner appropriate to the medium, which for a model usually means a credits section in the model card or documentation. A list of datasets with their licences discharges most attribution obligations, and you want that list anyway.