Art. 4 of Directive 2019/790: What TDM Actually Means for Data Infrastructure
Most organizations that work with large volumes of public internet data operate in a legal grey zone they barely acknowledge. They process signals, extract insights, feed AI models — and rarely stop to ask whether the legal scaffolding beneath those operations is sound. Article 4 of EU Directive 2019/790 is that scaffolding. Understanding it precisely is not a legal exercise. It is an operational one.
The Directive was transposed into Spanish law via Article 67 bis of the LPI (Ley de Propiedad Intelectual). But its relevance is not confined to Spain or the EU. Any organization processing publicly accessible content to generate derived analysis — regardless of where it is headquartered — needs to understand what this framework permits, what it restricts, and what conditions must be met to operate within it.
What Article 4 Actually Says
Article 4 of Directive (EU) 2019/790 establishes an exception to copyright and related rights specifically for Text and Data Mining (TDM). It allows any person with lawful access to content to reproduce and extract from it for the purpose of mining — provided the rights holder has not expressly reserved those rights in an appropriate manner, such as machine-readable metadata.
This is the operative sentence most commentators skip past too quickly. The exception applies by default to lawfully accessible content, unless the rights holder opts out. That opt-out must be explicit and machine-readable — a robots.txt directive, a metadata tag, a contractual restriction embedded in terms of service.
The practical consequence: an enormous volume of the public internet universe falls within the scope of this exception. Content published openly, without opt-out signals, is available for TDM under the framework of Article 4. This is not a loophole. It is the intended design of the Directive.
The Distinction That Changes Everything: Reproduction vs. Derived Analysis
The legal architecture of Article 4 rests on a distinction that is also the core technical distinction in any serious data infrastructure: the difference between reproducing content and generating derived analysis from it.
Reproducing content means storing, redistributing, or displaying the original text in a way that substitutes the original source. That is outside the TDM exception — and rightly so. Generating derived analysis means processing content to extract signals, patterns, mentions, trends, or structured insights that did not exist in the original. The original content is consumed in the process; what is delivered downstream is fundamentally different from what was ingested.
This distinction is not semantic. It determines the legal status of your entire data pipeline. Organizations that conflate the two — that store raw content long-term, that redistribute article text to end users, that offer "news feeds" as a product — are not operating under the TDM exception. They are operating as content distributors, which is a different legal category with different requirements.
At TrawlingWeb, the entire infrastructure is built around this distinction. What flows through the system is processed signal, not raw content. Mentions, frequencies, sentiment vectors, entity co-occurrences, topic trends — these are the outputs. The source content is not the deliverable.
Three Operational Conditions That Cannot Be Ignored
Article 4 is not a blanket permission. It comes with conditions that must be embedded into the technical and organizational architecture of any TDM operation.
1. Lawful access. The content being processed must be lawfully accessible. This means it is publicly available without technical circumvention, and the access itself does not violate terms of service in ways that invalidate lawfulness. Assessing lawful access is a continuous operational task, not a one-time legal check.
2. No express opt-out. If a rights holder has expressed a machine-readable reservation of rights, that reservation must be respected. Robust TDM infrastructure must be capable of reading, interpreting, and acting on opt-out signals at scale — automatically, not manually.
3. Purpose of TDM. The processing must be genuinely aimed at mining: generating insights, training models, identifying patterns. Using the TDM exception as cover for building a content archive or a redistribution platform does not survive legal scrutiny.
These three conditions are not bureaucratic checkboxes. They are engineering requirements that must be wired into the pipeline from the first stage of data access through to the final output format.
Why This Matters for AI Training Data
The intersection of Article 4 and AI has become one of the most contested areas in European digital policy. The question of whether large language model training qualifies as TDM under Article 4 is still being worked out in courts, regulatory guidance, and industry practice.
What is clear is this: organizations that can demonstrate a principled, documented TDM framework — lawful access policies, opt-out compliance mechanisms, derived-output architectures — are in a structurally stronger position than those that cannot. As regulators and litigants sharpen their focus on AI training datasets, the organizations that built their infrastructure on Article 4 principles from the start will face significantly less exposure than those that built on convenience.
The AI Act and the evolving enforcement posture of national copyright authorities are converging toward a world where data provenance and processing legality must be demonstrable, not merely asserted. Article 4 is the foundation that makes that demonstration possible.
Building on the Right Foundation
The organizations that will navigate the next five years of data regulation most effectively are not the ones with the largest legal teams. They are the ones that made the right architectural decisions early: separating ingestion from storage from output, treating opt-out signals as first-class data, and designing their products around derived analysis rather than content redistribution.
Article 4 of Directive 2019/790 does not just define what is legally permitted. It defines what a serious, durable data infrastructure looks like. The legal framework and the technical best practice point in exactly the same direction.
If your current pipeline cannot clearly answer the question — what is the difference between what we ingest and what we deliver? — that is the gap worth closing first.