Truace
Subscribe

Legal study finds AI chatbots absorb user prompts, exposing privacy and copyright gaps

Study title: Legal Ethics of Generative Artificial Intelligence Training Data Usage in Large Language Models: Copyright and Personal Data Perspective

A normative legal study reviewed the legal frameworks of Indonesia, South Korea, the European Union and Japan and tested LLM prompts directly. It found that large language models continuously absorb users' input prompts, data and corrections to support further training, which exposes security weaknesses under personal data protection laws.

Read the study abstract

This research originates from security and privacy risks associated with Generative AI Large Language Models (LLMs), especially concerning data used for training in relation to Intellectual Property Rights (IPR) and Personal Data Protection (PDP). The study seeks to examine existing regulatory guidance and develop a national framework that protects user privacy and IPR. The method employs normative legal research using statutory and conceptual approaches, by reviewing the legal frameworks of Indonesia, South Kor…

Truvace record2 min read1 sourceEvidence: Emerging · 30/100 — Commentary, opinion, or narrative review · 1 independent sourcePeer-reviewedTRV-2026-2413 · cite or check it
Legal Ethics of Generative Artificial Intelligence Training Data Usage in Large Language Models: Copyright and Personal Data Perspective"Nauru Parliament chamber" by Alistair1978, CC BY-SA 4.0.

In brief

The authors argue that without strong human creative control and predictability, each incoming data item may breach privacy and copyright laws and may damage original creators. This matters because the training pipeline itself, not only the outputs, becomes a source of legal risk for both users and rights holders.

The paper proposes that governance move toward explicit licensing, fair compensation and technical verification such as provenance labeling. It also calls for a national framework protecting user privacy and intellectual property, though it describes these as recommendations rather than tested measures.

Main points

  1. The study used normative legal research with statutory and conceptual approaches, comparing the legal frameworks of Indonesia, South Korea, the European Union and Japan.
  2. Researchers also ran direct tests of LLM prompts to see how the systems handle user input.
  3. LLMs continuously absorb users' input prompts, data and corrections to support deeper model training.
  4. That absorption reveals significant security vulnerabilities under personal data protection laws.
  5. Without strong human creative control and predictability, incoming data items may breach privacy and copyright laws and may harm original creators.
  6. The authors recommend explicit licensing, fair compensation and provenance labeling as technical verification standards.
  7. They conclude that mandatory human-centric supervision, explicit user consent and freedom of choice are essential legal limits.

The problem

A legal analysis of Indonesian, South Korean, EU and Japanese rules found that large language models keep absorbing users' prompts, data and corrections for training, which exposes security weaknesses under personal data protection laws and risks harming original creators.

The full story

The research starts from security and privacy risks tied to generative AI large language models, focusing on training data in relation to intellectual property rights and personal data protection. Its stated aim is to examine existing regulatory guidance and develop a national framework protecting user privacy and intellectual property.

The method combined a review of legal frameworks in four jurisdictions (Indonesia, South Korea, the EU and Japan) with direct testing of LLM prompts. The central finding is that models keep absorbing prompts, data and corrections, creating vulnerabilities under personal data protection law.

On remedies, the authors favour explicit licensing, fair compensation and provenance labeling, along with mandatory human-centric supervision, explicit user consent and freedom of choice. They describe a shared responsibility model: software engineers must provide technical transparency, expert oversight and responsive complaint mechanisms, while end users must choose platforms lawfully, follow output licensing requirements and monitor the system.

Sources

  1. Peer-reviewedJurnal Pembangunan Hukum Indonesia2026-11-06

The debate