The debate regarding reservation of rights (opt-out) for AI training has shifted from principles to infrastructure. The German decision in the LAION case rekindles the key issue: how to turn ‘machine-readable’ into a ‘machine-actionable’ mechanism that is interoperable and proportional.
The European debate on AI training no longer focuses on ‘whether’ text and data mining (TDM) is covered by the exception, but rather on ‘how’: what does a rightsholder have to do to apply the opt-out provided in article 4(3) of Directive (EU) 2019/790 and what can be demanded of a large-scale operator.
The Higher Regional Court of Hamburg links ‘machine-readable’ to automatic execution. The reservation of rights should not only exist, but it must also be able to be located, interpreted and applied reliably by automated systems, since TDM itself is an automated process.
The scenario is complex. The LAION judgment is under review at the German Supreme Court (BGH). In parallel, the CJEU is addressing a request for a preliminary ruling in case C-250/25, Like Company v. Google Ireland Ltd, with a potential impact on how generative AI ties in with the Copyright Directive. In addition, the European Commission has launched a consultation on opt-out protocols, with a view to moving beyond the concept of ‘machine-readable’ to technical and verifiable signals.
The Commission consultation: from legal standard to operational expectation
The Commission’s consultation seeks to turn the threshold of ‘actionability’ into a layer of compliance for AI providers. While the LAION case raises the technical bar, it does not create interoperability — a void that the Commission seeks to address. The Like Company case could, in turn, consolidate the Copyright Directive as the main regulatory framework for generative AI. If this occurs, the opt‑out under Article 4(3) of the Directive will become the key to modulating the use of content, defining when the TDM exception does not apply.
LAION provides an operational criterion
The LAION case provides that a reservation of rights is ‘machine-readable’ when an automated process can detect it and act in consequence, without human interpretation. A signal that requires semantic comprehension is not reliable at scale. Consequently, natural language prohibitions (T&C for humans) are weak as an automated block.
Technological determination: ‘opt-out’ is not a static adjective
The effectiveness of the opt-out depends on how ingestion systems operate at all stages (crawling, indexing, training, etc.). Interoperability, which is vital in this process, is a contextual property with technical, semantic and organizational layers that depend on the state of the art and institutional design.
For article 4(3), machine-readable’ means that the reservation must be reliably actionable and traceable on a massive scale. Relying on the probabilistic interpretation of a linguistic model would make compliance impossible to verify and legally inconsistent. An opt-out that needs to be interpreted on a case-by-case basis is incompatible with the scale of TDM and eliminates legal certainty for developers and effective control for rightsholders.
The effectiveness of the opt-out does not just depend on how the reservation is expressed, but also on the private management layer that controls access (T&C, licenses, APIs). Even with a ‘machine-actionable’ reservation, the market can turn towards payment models that create friction and penalize players who do not have negotiating capacity. Therefore, the debate regarding actionability is also a debate about costs, entry barriers and market balance.
Conflicting signals from the courts: The Netherlands and Denmark do not have the same requirements
Before LAION, judgments were already inconsistent. In the Netherlands (DPG Media v. HowardsHome), the court leaned towards a logic of practical detectability and processability, akin to ‘actionability’. In Denmark (BoligPortal A/S v. ReData A/S) on the other hand, a text in a public HTML policy placing ‘online advertising’ on a par with ‘machine-readable’ was accepted as valid.
If what is considered ‘appropriate’ varies by jurisdiction, article 4(3) loses its uniform scalability in the internal market.
The role of the CJEU with Like Company
The question referred for a preliminary ruling in C-250/25 (Like Company) focuses on whether the training of an LLM entails reproduction and public communication. Its side effect will be to boost the operational importance of the opt-out under article 4(3), since the CJEU could influence what is considered an ‘adequate’ reservation and what level of diligence is considered reasonable for compliance on a massive scale.
The problem is not just ‘what signal’, but ‘what does it mean’
A machine-actionable opt-out requires the system to translate the signal into a consistent decision (do not train, do not index). Without a common vocabulary, ‘machine-readable’ is a pipe dream: the machine sees a signal but cannot interpret it in a stable manner between different protocols.
Vocabulary depends on infrastructure and also on competition: IETF, Cloudflare, RSL
If open convergence is delayed, the market creates de facto standards. The IETF (AI Preferences) seeks an open vocabulary, whereas Cloudflare (Content Signals) and RSL propose their own systems, geared towards categories of use or payment models, which could standardize pay per crawling.
When it comes to defining standards, neutrality is exceptional. Whoever defines the vocabulary can tilt the competitive balance and end up writing the practical rules of the market. Consequently, the Commission’s consultation is a decision about governance of the internal market, not simply a technical formality.
Why robots.txt is not enough: art, multimodality and the ‘small-scale’ creator
robots.txt only works when there is a clear website control point (a domain). It is not useful for works replicated in networks, catalogs or marketplaces; art where the file (image, video) is the work; or content distributed outside classic websites.
And the most overlooked case: the small-scale creator without a stable, dedicated channel. If the work circulates as a file (email, messaging, Drive/WeTransfer), robots.txt becomes irrelevant. This is where the technological nature of opt-out becomes clear: its effectiveness depends on the tools available to the creator and on the actual channel through which the work is distributed.
This is why signals embedded in the asset itself are gaining importance: IPTC Photo Metadata (PLUS) and its Data Mining field; IPTC Best Practice Recommendations which combine metadata and headers; and C2PA/Content Credentials as a framework for verifiable provenance and association— useful for traceability and compliance, even though it is not a license in itself. If the ‘machine-actionable’ standard is based only on web-centric mechanisms, article 4(3) of the Directive runs the risk of becoming asymmetric: effective for large players with infrastructure, but weak for individual creators.
A silent risk
At this stage, the risk is not the absence of a solution, but the silent consolidation of a substandard solution: incompatible signals, private dictionaries and compliance that cannot be verified. In that scenario, there will be no more protection or innovation, only more litigation and greater asymmetry.
For operators, the key question is what standard of diligence will be required tomorrow. Upcoming rulings (BGH and CJEU) will establish the legal threshold, while AI regulation will translate it into operational expectations. Where those two paths cross is where it will be decided whether ‘machine‑readable’ will come to mean ‘verifiable and executable’ or whether it will remain an empty term.