Somewhere right now, something is reading your website. It isn't a customer, and it probably isn't even a person. It's a piece of software with a name like GPTBot or ClaudeBot, and it isn't there to book a table or ask for a quote. It's there to copy your words (your menu descriptions, your portfolio captions, the "about us" page you wrote at midnight) into a pile of text that trains someone else's AI model. Forever, and without asking.
I'd never really thought about this until a photographer client asked me a simple question: "if I put my best work on my website, am I just handing it to a machine for free?" I didn't have a confident answer. So I went and found one.
What "training" actually means
When people talk about AI "training on your website," they mean this: companies building AI models send automated crawlers around the internet, the same way Google does, except instead of building a search index, they're building a dataset: millions of pages of real writing and images that teach the model what human language and pictures look like. Your website is one page in a dataset of billions.
There's nothing sinister about the mechanism itself. It's closer to a very fast, very thorough reader than a hacker. The question that actually matters is whether that reader needed your permission, and until this year, nobody had a real answer.
The lawsuit that (mostly) answered it
In 2025, a US federal judge, William Alsup, ruled on a case brought by authors against Anthropic, the company behind Claude. The result surprised a lot of people: he found that training an AI on copyrighted books is, on its own, lawful. He compared it to how a writer studies other writers' work to learn craft. What wasn't lawful was where Anthropic got some of those books: pirated copies from illegal shadow libraries. Anthropic settled for $1.5 billion over that specific sourcing problem, not over the training itself.
So the current legal shape, as of this year, is: reading your public content to train an AI is very likely allowed. Stealing it from somewhere it was never supposed to be available is not. That's a real distinction, but it's not much comfort if what you actually wanted was a "do not train on this" button, because legally, for content you published yourself, that button doesn't really exist yet. Courts are still working out the edges case by case, and nobody serious expects the picture to be final for a few more years.
The one lever you do have
Here's the practical part. Your website has a small text file called `robots.txt` that tells automated visitors what they're allowed to do. Most AI companies' crawlers (GPTBot, ClaudeBot, Google-Extended, CCBot, and a dozen others) say they respect it. You (or whoever built your site) can add a few lines telling each of those bots not to come in.
It's a genuinely useful thing to know exists. It's also worth being precise about what to block, because not every AI bot is doing the same job. Some, like GPTBot and ClaudeBot, exist purely to gather training data. Others, like OAI-SearchBot or PerplexityBot, exist to answer someone's live question by citing your page, closer to how Google sends you a visitor than to a dataset. Blocking everything with "AI" in the name can mean blocking the exact traffic that was about to become a customer. Block the training bots if that's your worry; leave the search ones alone if you'd rather show up when someone asks an AI assistant "where can I get this fixed near me."
What it can't do
I want to be honest about the size of this lever, because it's smaller than it sounds. `robots.txt` is a request, not a lock: it works only on crawlers that choose to respect it, and plenty of smaller or less scrupulous scrapers simply don't. It does nothing for anything already collected before you added it; there's no "forget my website" button on the other end. And it protects nothing that's already out on other platforms (a review site, a marketplace listing, a photo someone else reposted) because that content was never yours to block from.
So this isn't a fix. It's a small, real thing you can do, sitting next to a much bigger truth: once something is public on the internet, some version of "someone might learn from it" is now baked into what publishing means. That was true before AI, in a smaller way (search engines, archive sites, scrapers of every kind), and AI training has made it a bigger question, not a new one.
I wrote a while back about the other half of this same worry: what happens when you type your own client and supplier details into a chatbot, which is a decision you make every time you open ChatGPT. This is the quieter half: what happens to what you've already published, without you doing anything at all.
One thing to do this week
Ask whoever manages your website (or check yourself, it's one file) what your `robots.txt` currently says about AI crawlers. Most sites built before this year say nothing at all, which means every major AI training bot is welcome by default. Whether you decide to block them, allow them, or just allow the search ones, that should be a choice you made on purpose, not a setting nobody ever touched.