Publishers back a common standard for tracking AI content use

What the standard records

The specification identifies five principal content events: retrieved, grounded, cited, presented and engaged. Retrieval means that content was fetched. Grounding means that it entered the generation context. Citation records an explicit reference in an output. Presentation records that content or a source reference was made perceptible to the recipient. Engagement covers conduct such as clicking, copying, sharing or directing an agent to act.

The distinction is commercially useful. Retrieval without grounding may show that an article was fetched but not used in an answer. Grounding without citation may indicate that the content influenced an output without visible attribution. Citation without presentation may mean that a reference existed internally but was not shown to the user.

The standard uses session and content identifiers to connect events and can link a usage event to a separate licence through a licence reference. It is designed to work alongside different licensing or access systems rather than prescribe one commercial model.

What telemetry does not prove

SPUR's own specification recognises important evidential limits. Grounding, citation, presentation and engagement events are generally reported by the agent or platform whose conduct may affect payment under a licence. In version 1.0, signing is informational rather than mandatory, and no required proof independently verifies that every reported event is true or that all qualifying events were included.

A correlation header can allow a publisher's server or content-delivery network to corroborate a retrieval event. It does not independently prove later grounding, citation or presentation. Signing could establish who emitted a report, but would not by itself prove completeness or factual accuracy.

Businesses should therefore treat telemetry as a structured evidence source, not conclusive proof. Contracts may need audit rights, coverage declarations, reconciliation procedures, sampling or other controls where fees or compliance decisions depend on the data.

The UK copyright position is different from the EU model

In the United Kingdom, section 29A of the Copyright, Designs and Patents Act 1988 permits copies for computational analysis only where a person has lawful access and the sole purpose is non-commercial research, subject to acknowledgement requirements. Commercial AI training does not receive a general statutory text-and-data-mining exception under that provision.

As the UK Intellectual Property Office explains, commercial text and data mining will commonly require permission or a licence unless another exception applies or the material is not protected. The government published a copyright and AI impact assessment in March 2026 but said it would not reform copyright law until confident that the chosen approach meets its objectives. An industry telemetry protocol does not change that current legal baseline.

A licence should identify the content and uses permitted, such as model training, retrieval, grounding, summarisation, display or agent action. A telemetry record may help measure performance under those terms, but it cannot supply permission that the licence or law does not provide.

EU duties operate on a separate legal layer

Article 4 of the EU Copyright in the Digital Single Market Directive provides a text-and-data-mining exception subject to conditions, including the ability of rightsholders to reserve relevant rights in an appropriate manner. For content made publicly available online, the reservation must be expressed by machine-readable means.

Article 53(1)(c) of the EU AI Act requires general-purpose AI model providers to maintain a policy for compliance with EU copyright law and, in particular, to identify and comply with Article 4(3) rights reservations through state-of-the-art technologies. Article 53(1)(d) separately requires a sufficiently detailed public summary of training content using the AI Office template.

Those provisions should not be collapsed into telemetry. A rights-reservation signal states that a rightsholder has withheld reliance on the Article 4 exception. Telemetry reports how content was used. A licence determines the permission and commercial terms. A training-content summary serves a statutory transparency function at model level. One mechanism does not automatically satisfy all the others.

The European Commission is separately working to identify generally agreed machine-readable opt-out protocols. SPUR's publication and membership growth do not establish that its telemetry specification has been formally recognised as such a protocol, and the specification itself focuses on reporting rather than access permission.

Privacy and security require their own design

Usage reporting can expose information about queries, reading interests, commercial research, users, sessions and internal model behaviour. A telemetry programme therefore needs data minimisation, purpose limitation, access controls, retention periods and an assessment of whether identifiers can be linked to individuals or confidential customer activity.

Publishers receiving telemetry should collect only the detail needed for licensing, audit or attribution. AI providers should avoid transmitting raw prompts or unnecessary personal data merely to prove that content contributed to an answer. Aggregation, pseudonymous identifiers and carefully designed privacy levels can reduce exposure, but they do not remove the need for a lawful basis and security controls where personal data remains involved.

Security also matters because a reporting endpoint, manifest or identifier may be spoofed or abused. Implementers should authenticate endpoints, validate schemas, rate-limit submissions, protect signing keys and separate telemetry ingestion from production publishing systems.

Practical actions for publishers, AI providers and platforms

1. Map each content use separately. Distinguish discovery, crawling, indexing, model training, retrieval, grounding, citation, presentation, caching and downstream agent action.
2. Identify the legal basis for every use. Record the licence, statutory exception, rights reservation or other permission relied on for each territory and purpose.
3. Keep permission and reporting distinct. A telemetry event should reference the governing licence where possible, but must not be treated as creating permission by itself.
4. Define the measurement contract. Specify the event types, coverage mode, reporting frequency, identifiers, attribution rules, retention period, correction procedure and treatment of cached or syndicated content.
5. Address verification. Consider corroborated retrieval logs, signed submissions, audit rights, sampling, canary content and reconciliation where payments depend on self-reported events.
6. Protect user and customer information. Avoid raw prompts and direct identifiers unless strictly necessary. Document the lawful basis, minimisation measures, recipients, international transfers and deletion schedule.
7. Test rights signals independently. Ensure crawlers and training pipelines recognise applicable machine-readable reservations, record the signal and time observed, and apply the correct territorial rule.
8. Preserve model-level evidence. Keep training-source governance, dataset provenance and the information needed for any applicable AI Act training-content summary separate from session telemetry.
9. Review competition and fairness terms. Publishers and platforms should assess exclusivity, most-favoured-nation clauses, discriminatory access, bundling and whether smaller publishers or AI providers can participate on reasonable terms.
10. Describe adoption accurately. State whether a system supports the specification, which version and profile it implements, the proportion of events covered and any limitations. Do not describe voluntary implementation as statutory compliance or independent certification.

The compliance conclusion

SPUR's growing membership gives the telemetry project greater commercial relevance. A common vocabulary could reduce friction in licensing negotiations and provide publishers with better evidence about how AI systems use their work.

Its value will depend on implementation, coverage and verification. The standard does not settle whether a use is licensed or lawful, and it does not replace the UK and EU copyright rules that determine permission. The sound approach is to connect three separate layers: rights signals and licences governing access, telemetry measuring use, and auditable controls supporting legal compliance and payment.