Data ownership is the bundle of legal rights that decides who controls a set of information, who can access it, who can profit from it, and who can stop others from using it. It is not a single property right the way owning a car is. In the United States, no comprehensive federal statute defines it, so what you actually “own” when you own data depends on what the information is, how it was created, and which laws and contracts govern it.
Why Data Isn’t Owned Like Physical Property
You cannot hold data in your hand, and multiple parties can possess identical copies of the same information at the same time. That physical reality is why lawyers rarely describe data ownership as a single right. They describe it as a collection of interests: the authority to decide how information is collected, who sees it, how long it is stored, and whether anyone else can profit from it. Legal scholars often compare these interests to the “bundle of sticks” in property law, where different rights can be separated and assigned to different parties.
The framing matters because raw facts generally cannot be copyrighted, and personal information about you does not belong to you the way your house does. Privacy and data protection laws instead grant specific, enumerated rights over your information. When someone says they own their data, they usually mean they have the legal authority to control what happens to it. That authority comes from statutes, regulations, and contracts, not from any inherent property right in the data itself.
The Rights That Make Up Data Ownership
Across the major privacy frameworks, the same handful of rights keep appearing. Together they are the practical meaning of “owning” data for most people.
Control and Access
The foundational right is control: deciding whether your information is collected at all, and how it is used afterward. Under California’s Consumer Privacy Act, consumers can direct businesses not to sell or share their personal information and can limit how companies use sensitive data like Social Security numbers or precise geolocation.1Office of the Attorney General – State of California Department of Justice. California Consumer Privacy Act The European Union’s General Data Protection Regulation requires affirmative consent before processing personal data for most purposes.
Access rights let you see what an organization has actually collected. Under the CCPA, you can request the specific pieces of personal information a business holds, the sources it collected them from, and which third parties received them, up to twice per year at no charge.1Office of the Attorney General – State of California Department of Justice. California Consumer Privacy Act The GDPR provides a similar right and requires responses in a commonly used electronic format.
Portability
Portability lets you take your data with you when you leave a service. Under GDPR Article 20, you can receive your personal data in a structured, machine-readable format and transfer it directly to another provider when technically feasible.2General Data Protection Regulation (GDPR). Art. 20 GDPR Right to Data Portability The right exists to keep companies from locking you into a platform by making it impossible to move your information elsewhere.
Erasure
The right to erasure, sometimes called the right to be forgotten, lets you demand that an organization permanently delete your personal data. GDPR Article 17 requires controllers to erase data without undue delay when the information is no longer necessary for its original purpose, when you withdraw consent, or when the data was processed unlawfully.3General Data Protection Regulation (GDPR). Art. 17 GDPR Right to Erasure In practice, the obligation extends beyond live databases to backup systems, though regulators recognize that backup data may remain until it is overwritten on a regular schedule, as long as it is placed beyond use in the interim.
The CCPA grants a comparable deletion right, but with broader exceptions. Businesses can refuse a deletion request if they need the data to complete a transaction, comply with a legal obligation, detect security incidents, or exercise legal claims.
The Right to Exclude
The right to exclude is the ability to prevent others from using your information without permission. In property law, the right to exclude is often considered the defining feature of ownership itself. Applied to data, it means an owner can block unauthorized parties from accessing, copying, or profiting from the information. In commercial settings, these rights are frequently split: one party might license the right to use data for a specific purpose while the original owner retains the power to exclude everyone else.
Where U.S. Data Rights Actually Come From
The United States has no single federal data privacy statute. Rights are scattered across sector-specific federal laws and a growing set of state regulations. The Federal Trade Commission is the primary enforcer at the federal level, using Section 5 of the FTC Act, which prohibits unfair and deceptive business practices, to bring actions against companies that mishandle consumer data or break their own privacy promises.4Federal Trade Commission. Privacy and Security Enforcement That authority is broad but reactive: the agency typically acts after a violation rather than setting detailed rules in advance.
Two frameworks do most of the heavy lifting on defining rights. The GDPR applies to any organization worldwide that handles EU residents’ data and has become a global benchmark.5General Data Protection Regulation (GDPR). Art. 5 GDPR Principles Relating to Processing of Personal Data The CCPA, although a state law, reaches any sizable business that collects personal information from California residents and has inspired similar laws in more than a dozen other states.1Office of the Attorney General – State of California Department of Justice. California Consumer Privacy Act
Limits on What Can Be Collected
Ownership is not only about what you can do with your data. It also limits what organizations can demand from you in the first place. The principle of data minimization, codified in GDPR Article 5, requires that personal data be “adequate, relevant and limited to what is necessary” for its stated purpose.5General Data Protection Regulation (GDPR). Art. 5 GDPR Principles Relating to Processing of Personal Data
In practical terms, a company cannot collect everything it can get and justify the collection later. A weather app asking for access to your contacts fails the relevance test. Organizations must also set retention limits, keeping data only as long as the stated purpose requires. The FTC has treated excessive collection as a deceptive practice under Section 5, bringing actions against companies that collected far more data than their privacy policies disclosed.
Ownership Rules by Industry
Health Records
HIPAA gives patients specific rights over their protected health information. Under 45 C.F.R. § 164.524, you can inspect and obtain a copy of your medical records, billing records, and other information used to make decisions about your care. Providers must respond to access requests within 30 days, with one possible 30-day extension if the provider explains the delay in writing.6eCFR. 45 CFR 164.524 Access of Individuals to Protected Health Information Patients can also request corrections to inaccurate records, though providers retain discretion over whether to make the change.
Worth noting as a boundary: HIPAA does not give patients full property ownership of their health data. The healthcare provider typically owns the record itself. What HIPAA grants is a strong set of access and control rights over the information inside it.
Financial Information
The Gramm-Leach-Bliley Act requires banks, lenders, insurance companies, and other financial institutions to explain their data-sharing practices and give consumers the right to opt out of having their nonpublic personal information shared with unaffiliated third parties.7Federal Trade Commission. Gramm-Leach-Bliley Act Institutions must provide the opt-out opportunity before sharing and must offer a reasonable method for exercising it. The FTC’s Safeguards Rule separately requires covered companies to maintain a written information security program to protect customer data.
How Contracts Reassign Data Rights
When statutes are silent, contracts fill the gap. Most commercial disputes over who owns data get decided by contract terms rather than statute.
Terms of Service
Nearly every online platform requires users to accept terms granting the company a license to use uploaded content. The scope varies enormously. Some platforms take a narrow license limited to displaying your content on their service. Others claim broad rights. One major newspaper’s terms grant it an irrevocable, perpetual, worldwide, exclusive license to reproduce, modify, distribute, and create derivative works from any content users submit. Most users never read these provisions, which is exactly why they matter: they can transfer significant data rights without the user realizing it.
Work Made for Hire
Under copyright law, a “work made for hire” is either a work created by an employee within the scope of employment or a work specially commissioned under a written agreement for certain limited categories like compilations or contributions to a collective work.8Office of the Law Revision Counsel. 17 USC 101 Definitions When a work qualifies, the employer is considered both the author and the copyright owner from the outset.9U.S. Copyright Office. Circular 30 Works Made for Hire
An important caveat: this doctrine covers copyrightable works, not all data. Raw factual data you enter into a company database is generally not copyrightable at all. Employers typically secure rights over that kind of information through employment agreements and trade secret law rather than through copyright’s work-for-hire rules.
Derived Data
Some of the most contentious ownership disputes involve derived data: new information generated by analyzing someone else’s raw inputs. A common pattern in software agreements is that the customer owns the data they submit, but the vendor owns any de-identified, aggregated insights created from processing that data. Under these provisions, a vendor might freely sell statistical trends built from thousands of customers’ information, while each individual customer retains rights only to their own inputs.
These clauses deserve careful scrutiny. Contracts sometimes grant the vendor an unrestricted, perpetual right to use derived data for any purpose, including selling it to competitors. The split between “your raw data” and “our analytics” sounds reasonable until you realize the analytics are often the more valuable product.
Data Processing Addendums
When businesses share personal data with cloud providers or other processors, a data processing addendum spells out each party’s role. The client is typically designated as the “controller” who determines why and how data is processed, while the vendor serves as a “processor” acting on the controller’s instructions. These documents allocate liability for data breaches and regulatory violations. If the processor mishandles data, the addendum determines who pays and who notifies affected individuals. Some addendums let the vendor modify terms with as little as ten days’ notice, so ongoing review matters.
Who Owns AI-Generated Content?
Generative AI has created ownership questions existing law was not designed to answer. The core issue splits in two: who owns the data used to train AI models, and who owns the content those models produce.
On training data, no universally accepted legal framework governs whether feeding copyrighted material into a training dataset counts as infringement. Multiple lawsuits are pending, and outcomes hinge on whether courts treat AI training as fair use. Businesses are increasingly managing the risk through contracts, requiring AI vendors to represent that their training data was obtained lawfully and to indemnify customers against infringement claims.
On outputs, U.S. copyright law is clearer. Purely AI-generated content cannot be copyrighted. In 2025, the D.C. Circuit affirmed in Thaler v. Perlmutter that the Copyright Act requires all work to be authored by a human being, and an AI system cannot qualify as an author.10U.S. Court of Appeals for the D.C. Circuit. Thaler v. Perlmutter The Copyright Office’s January 2025 report reinforced this position, concluding that prompts alone do not give a user sufficient creative control over AI output to claim authorship.11U.S. Copyright Office. Copyright and Artificial Intelligence Part 2 Copyrightability Report
Copyright can still protect human contributions embedded in an AI-assisted work. If you write original text and weave AI-generated passages into it, your creative expression and your selection and arrangement of the material may qualify. The Copyright Office requires applicants to disclose any more-than-minimal AI-generated content and to describe what the human author actually contributed.12Federal Register. Copyright Registration Guidance Works Containing Material Generated by Artificial Intelligence The practical takeaway: if you relied heavily on AI to produce content, you likely do not own the output in any meaningful legal sense.
What Violations Cost
Financial consequences for mishandling personal data vary widely depending on which law applies.
- Under the GDPR, the most serious violations, such as ignoring data subjects’ rights or transferring data unlawfully to third countries, can trigger fines up to €20 million or 4% of a company’s total worldwide annual revenue, whichever is higher. Less severe infractions carry fines up to €10 million or 2% of global revenue.13General Data Protection Regulation (GDPR). Art. 83 GDPR General Conditions for Imposing Administrative Fines
- Under the CCPA, administrative fines reach up to $2,663 per unintentional violation or $7,988 per intentional violation, adjusted for inflation from the original $2,500 and $7,500 thresholds. Those numbers are per violation, and a single breach affecting thousands of consumers can generate enormous cumulative liability.14California Legislative Information. California Code CIV 1798.155 Administrative Enforcement
- The FTC brings actions under Section 5 for deceptive or unfair data practices, including a 2026 settlement with an automaker for collecting and selling geolocation data without informed consent.4Federal Trade Commission. Privacy and Security Enforcement
- A handful of states impose statutory damages for collecting biometric data like fingerprints or facial scans without consent. Damages typically range from $1,000 per negligent violation to $5,000 per intentional violation, and class actions in this area have produced settlements in the hundreds of millions.
All 50 states, the District of Columbia, and U.S. territories now require organizations to notify individuals when a security breach exposes their personal information. Deadlines vary, with some states requiring notice within as few as 30 days. Missing the deadline can trigger additional penalties on top of any underlying privacy violation.