The Visual Artist's AI Opt-Out Guide: What Actually Works in 2026

Where Things Stand in 2026

Three layers of defense exist for visual artists trying to keep their work out of AI training sets — dataset, technical, and legal — and each has a different reach. Dataset-level opt-outs ask model trainers (or the people who curate the data they ingest) to skip your images. Technical defenses change what a crawler sees or what a model can learn from a file. Legal mechanisms rely on jurisdictions that have decided AI training is something rights holders can object to. None of the three is complete on its own. Used together, they meaningfully shrink the surface area of your work that ends up in the next model.

The 2026 picture is genuinely mixed. Some things shifted in artists' favor: in July 2025, Cloudflare introduced AI crawler blocking and a Pay Per Crawl marketplace and rolled out a Pay Per Crawl system that uses the HTTP 402 status code to let sites charge bots for access. On the regulatory side, the EU AI Act becomes fully applicable on 2 August 2026, with obligations on general-purpose AI model providers — including a duty to honor machine-readable opt-outs — already in force since August 2025.

Other promises went unmet. OpenAI announced a Media Manager opt-out tool in May 2024 and committed to shipping it by the end of 2025. That deadline came and went, and as of early 2026 the tool still does not exist. The rest of this guide walks you through what is actually working right now, in the order you should tackle it.

Dataset-Level Opt-Outs (Spawning, Have I Been Trained, OpenAI)

Dataset-level opt-outs work upstream of the model. Instead of altering your files or invoking a law, you flag your work in the dataset that trainers ingest, and ask the trainer to skip it on the next training run. The reach of this approach depends entirely on whether the model maker has agreed to honor the flag — which is why the picture varies so sharply between Stability AI and OpenAI.

The cleanest dataset-level lever for visual artists is Spawning's Have I Been Trained tool. HIBT searches LAION-5B — the open dataset behind Stable Diffusion — and lets you register opt-outs that participating model trainers commit to honor. Stability AI made that commitment for Stable Diffusion 3, meaning images you flag through Spawning are excluded from SD3's training data. By March 2023, artists had used HIBT to flag roughly 80 million artworks for removal from SD3 training, which tells you both that the system is real and that it is being used at scale. If your work is searchable in LAION-5B, registering an opt-out through Spawning is the highest-leverage single action you can take this week.

One practical note: the public HIBT search interface has been intermittently offline for maintenance. If the search page is not loading when you go to use it, Spawning offers an API alternative, or you can simply wait and retry — the underlying opt-out registry has continued operating through site downtime.

OpenAI is the harder story. The Media Manager opt-out tool the company promised in 2024 still does not exist in 2026, and there is no equivalent registry where you can flag images and expect them to be excluded from future GPT or DALL-E training. The only working OpenAI-facing lever today is blocking GPTBot in your site's robots.txt, which OpenAI documents as a forward-looking, voluntary signal — it does not retroactively remove anything already ingested. We cover the robots.txt setup in the next section.

Technical defenses you can deploy this week

This is the layer where you have the most direct control. None of it requires a lawyer, a lawsuit, or a regulator. It also will not stop a determined scraper. Treat these tools as friction and signal — they raise the cost of taking your work and create a record that you said no.

Cloak and poison: Glaze and Nightshade

Glaze and Nightshade come from the same University of Chicago lab and do opposite things. Glaze applies barely-perceptible "style cloaks" to your images so a model trained on them learns the wrong style — a defensive tool you run on each piece before posting. Nightshade goes further: it poisons training data so scraped images actively corrupt the models that ingest them, an offensive tool aimed at making your work toxic to indiscriminate scrapers. Adoption has been substantial — Glaze passed six million downloads since March 2023, and Nightshade crossed 1.6 million since January 2024.

Be honest with yourself about the ceiling. In 2025, researchers presented LightShed at USENIX Security, demonstrating a method that strips perturbation-based protections from images. Glaze and Nightshade are an arms race, not a shield. Use them, re-cloak when updates ship, and do not assume a cloaked image stays cloaked forever.

Tell the bots: robots.txt

A robots.txt file at your site root is the cheapest, clearest "do not train" signal you can post. Here is a current block list for the major AI crawlers:

User-agent: GPTBot
Disallow: /

User-agent: OAI-SearchBot
Disallow: /

User-agent: ClaudeBot
Disallow: /

User-agent: Claude-User
Disallow: /

User-agent: Claude-SearchBot
Disallow: /

User-agent: CCBot
Disallow: /

User-agent: Google-Extended
Disallow: /

User-agent: Applebot-Extended
Disallow: /

GPTBot covers OpenAI training, ClaudeBot covers Anthropic training, CCBot is Common Crawl (the dataset many models start from), and Google-Extended and Applebot-Extended carve out training use for Bard/Vertex and Apple Intelligence respectively. Older user-agents like anthropic-ai and Claude-Web no longer appear in Anthropic's official crawler list — the three above replace them, so older opt-out guides that still tell you to block those names are out of date. Robots.txt is voluntary; well-behaved crawlers honor it, bad actors do not.

Express the opt-out (EU): TDMRep

If you are reaching European audiences, the W3C's TDM Reservation Protocol is the machine-readable opt-out you want. You publish a small JSON file at /.well-known/tdmrep.json with a tdm-reservation flag set to 1, signaling reservation of rights under CDSM Article 4(3). The legal layer in the next section explains why this matters; for now, treat TDMRep as the EU-favored complement to robots.txt.

Platform-level: Cloudflare

If your site sits behind Cloudflare, you already have a one-click option. In July 2025, Cloudflare flipped its default to block AI crawlers for new sites and rolled out a Pay Per Crawl marketplace letting site owners charge for access. No per-page configuration, no robots.txt edits — toggle it on in the dashboard.

One last note: you will see suggestions to deploy ai.txt or llms.txt. Neither is a formally adopted W3C or IETF standard in 2026 — llms.txt is in early adoption, gaining momentum but still a developing convention — and neither carries the legal weight of TDMRep paired with CDSM Article 4(3). Deploy them as belt-and-suspenders coverage if you want, but do not rely on them as your primary opt-out signal.

The Legal Posture Right Now

Whether you have a legal lever against AI training depends almost entirely on where you sit. The US has no settled answer and a narrowed set of statutory tools. The EU has codified a real right to opt out of training, but only if you express that opt-out in a way machines can actually read. The UK is still mid-debate. None of these regimes will give you a clean win in 2026, but each shapes what your lawyer can credibly threaten and what platforms have to honor.

United States: pretrial, narrowed, wait-and-see

The two biggest US cases against AI training on visual or text works are still in pretrial posture. In Andersen v. Stability AI, the plaintiffs voluntarily dismissed their DMCA Section 1202 claims with prejudice after the court signaled that copyright-management-information removal claims require identicality between the original and the copy. The direct copyright infringement theory survived motion practice and the case is moving toward trial. In NYT v. OpenAI, the court denied OpenAI's motion to dismiss in March 2025 and discovery is now ongoing. Even the best-resourced plaintiffs in the country have not yet reached a verdict. For an individual artist, that means a wait-and-see posture is defensible.

European Union: a real right, conditional on machine-readable expression

EU rightsholders have something US artists do not: a statutory right to opt out of text and data mining. Article 4(3) of the EU Copyright Directive (CDSM) requires that the opt-out be expressed in an "appropriate manner, such as machine-readable means" for online content. That is why TDMRep tags matter: a blog post saying "please don't train on my work" does not satisfy Article 4(3); a structured machine-readable signal does. Article 53 of the EU AI Act, read with Recital 106, then extends this extraterritorially — any general-purpose AI provider offering a model in EU markets must put a copyright-compliance policy in place that identifies and honors those reservations, regardless of where the model was trained.

United Kingdom: rejected, unsettled

The UK government floated an EU-style opt-out exception in late 2024. The consultation ran 17 December 2024 — 25 February 2025 and drew thousands of responses, with creative industries leading the rejection. No opt-out regime is in force in the UK as of 2026; a government response is pending.

The practical takeaway for takedowns

If a generative model produces an output that nearly verbatim reproduces your specific work, DMCA Section 512 takedown notices remain viable. What courts have been more skeptical of is DMCA Section 1202 — claims that the AI company stripped your copyright information at the training stage when the outputs are not identical to inputs. So if you talk to a lawyer, anchor the conversation on output infringement, not training-stage CMI removal.

Platform Settings: DeviantArt, ArtStation, Instagram, Cara

Where you post matters as much as what you post. Platforms diverge sharply on AI training: some default every account to opt-out, some offer an opt-in tag you have to remember to apply, and some lock users in entire regions out of any opt-out at all. Before you upload, know which camp your platform falls into.

DeviantArt was first out of the gate. In November 2022 it introduced the noai and noimageai meta tag and HTTP header pair, opted every deviation out of AI datasets by default, and published the directives openly so any site could adopt them. The same company drew sharp criticism for launching its own DreamUp generator that month, which is worth keeping in mind when weighing platform incentives, but the technical opt-out itself is real and on by default.

ArtStation went the other direction. Its NoAI tag emerged from the December 2022 protest in which artists flooded the site with anti-AI images after Epic Games, ArtStation's parent, declined to ban AI-generated work outright. The tag is opt-in: you have to apply it to your portfolio or to individual pieces. Untagged work carries no signal at all.

Meta is the bluntest case. The opt-out form for Meta AI training is available only to users in the EU and UK (and select other regions where local privacy law gives them an opt-out right). If you are a US artist posting to Instagram or Facebook, there is no platform-level opt-out from Meta's AI training. That is not a setting you have missed; it does not exist for you. Many artists have responded by pruning archives, watermarking heavily, or moving their primary portfolio elsewhere.

Cara was built for that exodus. The platform grew from roughly 40,000 to 650,000 users in a single week of June 2024 after Meta's AI announcement, is built around an anti-AI-training stance, blocks AI-generated submissions, and partners with the Glaze project so artists can apply cloaking to their work. None of that makes Cara invincible against scrapers that ignore tags, but it stacks the defaults in the artist's favor.

Behance, Tumblr, Pixiv, and other platforms not covered here have their own evolving positions; check each one directly before assuming a default, because policies on this issue have shifted within months, not years.

What Doesn't Work

If a defense sounds like one click and done, it usually doesn't. Four common moves come up in artist forums that look protective on the surface but fall short under either technical or legal scrutiny. None of them are shameful to have tried — most of them were reasonable bets two years ago. They just don't carry the weight people assume.

Invisible watermarks alone

A 2024 NeurIPS paper, Invisible Image Watermarks Are Provably Removable Using Generative AI, showed that current invisible watermarks can be stripped by generative models without meaningfully degrading the image. Watermarks are useful for provenance and attribution downstream, but they do not stop training pipelines on their own.

Posting only low-res versions

Researchers note that modern training pipelines routinely apply random crops, downscaling, color jitter, and JPEG-compression augmentation as standard preprocessing. A model trained on heavily augmented data is, in effect, trained to ignore exactly the degradations a low-res-only posting strategy relies on.

Caption disclaimers like "© all rights reserved, not for AI"

These fail on both ends. Crawlers don't parse natural-language captions, and the EU AI Act's Article 53 — paired with the CDSM Article 4(3) reservation framework — requires opt-outs in machine-readable form. A free-text caption is neither technically respected nor legally sufficient as a reservation of rights.

"Copyrighting your style"

US copyright protects original expression in a specific work — composition, layout, individual details — not style as an abstract technique. The classic illustration is Steinberg v. Columbia Pictures (1987): the court found infringement because the defendants copied composition, perspective, and layout, not because they imitated a general look. Bleistein v. Donaldson Lithographing (1903) confirmed commercial illustration is copyrightable without an artistic-merit test, but it doesn't extend protection to style as a category. Plainly: you can register copyright on a specific work. You cannot copyright a style.

Layered defenses beat single solutions — there is no one switch.

Actionable Next Steps

If you only have an afternoon this week, work the list below in order. It compresses the three defensive layers from the prior sections — dataset, technical, and legal — into the smallest set of moves that actually changes your exposure.

1. Register your work on Have I Been Trained. This is the dataset-level opt-out that participating model trainers honor. It will not reach every lab, but it reaches the ones that publish opt-out commitments tied to Spawning's registry.
2. Update your robots.txt with the current AI user-agent block list. Use the sample directives from the technical-defenses section above and re-check the list quarterly — new crawlers ship faster than block lists update.
3. Glaze new uploads before you post them, and re-cloak older work whenever the Glaze team releases an update. Cloaking is a shifting target against retraining; treat it as maintenance, not a one-time step.
4. Toggle platform-level opt-outs everywhere you publish. DeviantArt's NoAI flag is on by default, ArtStation requires you to add the NoAI tag manually, Meta's opt-out form is region-locked, and Cara markets itself as opt-out-by-default. Audit each profile.
5. Write down a portfolio AI-use policy stating that your works are not licensed for AI training, and — if you sell into EU markets — deploy a TDMRep file at /.well-known/tdmrep.json to make that reservation machine-readable under the EU AI Act's training-data transparency regime.

When to talk to a lawyer

Most of the steps above are self-serve. A handful of situations are not, and getting counsel involved early changes what remedies stay available to you. Reach out when:

• An AI output reproduces a specific work of yours — not just your style — and you need a DMCA 512 takedown sent to the host or model provider.
• You sell commercially into the EU and need a written AI-use policy paired with a properly deployed TDMRep reservation that will hold up under Article 53 scrutiny.
• A third party is publishing derivative outputs that go beyond style mimicry — character likeness, composition, or recognizable elements — and a cease-and-desist is the right opening move.