Unsealed NYT filings intensify scrutiny of Microsoft and OpenAI training-data practices

The public filings and reporting refer to ChatGPT, OpenAI LLMs, Browse, Microsoft Copilot/Bing Chat, and historical training assets such as the GPT-3 training dataset. The exact model checkpoints, full dataset manifests, filtering code, and post-training recipes are not fully public in the unsealed reporting.

OpenAI’s September 4 memorandum describes the models as “generalist” LLMs trained from a broad and diverse internet corpus, including a filtered version of Common Crawl plus other datasets. It also discusses Browse as an automated web-browsing service that reads web sources in response to user requests and returns synthesized answers with links. [](https://storage.courtlistener.com/recap/gov.uscourts.nysd.612697/gov.uscourts.nysd.612697.1496.0.pdf)

Where exact versions matter, the public record is incomplete. The original Times complaint included examples involving GPT-family systems and Microsoft’s Bing/Copilot products, but the newly unredacted material does not, by itself, provide reproducible model-version documentation for every challenged output.

Architecture and data pipeline issues

The record does not newly disclose model architecture internals such as layer counts, attention variants, optimizer details, or full training-token mixtures. The technical significance is instead in data acquisition and governance.

The publishers allege multiple content channels: Common Crawl-derived datasets, OpenAI-built WebText-style datasets, Bing Index-related sharing, Project Taxi, Project Mango, mid-training datasets, and data passed between OpenAI and Microsoft. Bloomberg Law reports that Project Taxi allegedly delivered a Bing-gathered web compilation to OpenAI, while Project Mango allegedly involved a Microsoft-operated crawler funded by OpenAI. OpenAI, Microsoft Leaders Admitted AI Threatens News, Books (2)

For builders, the implementation implication is clear: “training data” is not one thing. Risk varies by stage:

• Pretraining: broad web-scale ingestion; hard to audit after the fact without manifests and hash-level lineage.
• Mid-training / post-training: curated “high-quality” or freshness-oriented data may create higher concentration of publisher works.
• Retrieval / Browse / grounding: live access to paywalled or licensed sources raises separate contract, robots.txt, paywall, and CMI issues.
• Output controls: memorization filters and refusal policies mitigate regurgitation but do not answer acquisition-lawfulness questions.

Evaluation methodology

The parties contest how often models reproduce protected expression. OpenAI’s September 4 memorandum says its expert reviewed a sample of 20 million ChatGPT conversation logs and found 24 alleged verbatim regurgitations, while plaintiffs’ experts found similarly low rates in some analyses; OpenAI also says adversarial or “forced” prompting experiments produced limited extraction under conditions unavailable to ordinary ChatGPT users. These are defense-reported expert results, not independent peer review. [](https://storage.courtlistener.com/recap/gov.uscourts.nysd.612697/gov.uscourts.nysd.612697.1496.0.pdf)

Independent research supports a narrower point: LLMs can memorize and regurgitate training text, but the rate and extractability vary by model, data duplication, prompt method, and target work. The paper The Files are in the Computer defines memorization as the ability to reconstruct a near-exact, substantial portion of training data from a model, while other work on copyrighted books finds that most models do not memorize most books but some books and some models are notable exceptions. The Files are in the Computer: Copyright, Memorization, and Generative AI Earlier ACL and security literature likewise treats verbatim memorization and training-data extraction as measurable but nonuniform phenomena. Copyright Violations and Large Language Models - ACL Anthology

Reproducibility

Independent reproduction is currently limited because the key artifacts are unavailable: sealed exhibits, nonpublic model checkpoints, internal datasets, filtering pipelines, user-query samples, and expert code. Practitioners should treat both sides’ numerical claims as litigation evidence, not benchmark results.

The core legal question is not simply “did the model read copyrighted text?” It is whether copying for training, post-training, grounding, and/or output generation is protected by fair use, and whether any outputs or data exchanges separately infringe copyright or DMCA provisions.

The defendants lean on a tradition of cases involving transformative use, search, indexing, and facts. OpenAI’s memorandum emphasizes that facts are not copyrightable and that LLMs answer in their own words after training on broad corpora. [](https://storage.courtlistener.com/recap/gov.uscourts.nysd.612697/gov.uscourts.nysd.612697.1496.0.pdf) The publishers argue the products substitute for their journalism and harm licensing and referral markets. The original Times complaint explicitly alleged that The Times permits search indexing for traditional search purposes but never authorized GenAI use. The New York Times Company v. MICROSOFT CORPORATION et al, 1:23-cv-11195, No. 1 (S.D.N.Y. Dec. 27, 2023)

The policy context has shifted toward AI-industry support: the U.S. government’s September 2026 statement backs a broad fair-use theory for AI training, while creator groups and news plaintiffs continue to frame unlicensed training as market-damaging extraction. US government backs OpenAI in New York Times copyright case By Reuters

1. Selective quotation risk: The strongest quoted language comes through the plaintiffs’ brief. Without full exhibits, tone, audience, and surrounding caveats are uncertain.
2. No final liability ruling: Unsealed allegations are not judicial findings.
3. Dataset counts ≠ output infringement: A corpus may contain works that never become extractable outputs; conversely, low observed regurgitation does not resolve whether acquisition was lawful.
4. Traffic harm is disputed: Plaintiffs point to answer-engine click-through reductions; OpenAI says expert analysis found no negative impact on publisher traffic or finances. [](https://storage.courtlistener.com/recap/gov.uscourts.nysd.612697/gov.uscourts.nysd.612697.1496.0.pdf)
5. Safety and privacy overlap: The dispute also touches user-log discovery. OpenAI says it has resisted demands affecting private ChatGPT conversations. Reporting the facts about the New York Times’ lawsuit | OpenAI

• Data provenance is now board-level risk: Maintain dataset manifests, license terms, crawl permissions, CMI handling records, and deletion/retraining playbooks.
• Separate training, retrieval, and output policy: A fair-use view on pretraining does not automatically bless paywall bypass, live retrieval, or verbatim output.
• Contract for indemnity carefully: Enterprise AI buyers should ask vendors what training-data warranties, copyright indemnities, and retrieval-source controls actually cover.
• Measure substitution, not just hallucination: For publishers and AI search providers, click-through, citation placement, snippet length, and answer completeness are economic design choices.
• Prepare for licensing markets: Even if some training is held fair use, curated mid-training, grounding, and premium-news access may move toward licensing or collective-management models.