Where the Evidence Sits: An Evidence Map of Dataset Licensing and Data Provenance Gaps Across 29 Research Corpora and 17 Standards

Every time a researcher downloads a digital file to test a new theory, or a developer copies a dataset to train an artificial intelligence, they are stepping into a chain of custody that is often invisible. These files are the raw materials of modern discovery, yet the rules governing their use are frequently unclear. A file might come from a university, a government archive, or a private company, and each source has its own set of permissions. Some allow anyone to use the data freely; others forbid commercial use or require that credit be given to the original creator. When a file is copied, moved, or mixed with others, these permissions must travel with it. If they do not, the person holding the file cannot know if they are allowed to share it, where it truly came from, or how it was made. Without this knowledge, the entire chain of research becomes fragile, built on assumptions rather than facts.

For years, audits of these digital collections have focused on the big picture. They have counted how many large datasets lack clear rules, finding that most major collections are missing the necessary paperwork. However, these broad checks often miss the details that matter most to the person actually holding a single file. They treat a collection like a single box, assuming that if the box has a label, every item inside shares the same rules. But in reality, a single dataset can contain files from dozens of different sources, each with its own unique history and legal status. When a file is extracted from that box and used in a new project, the big label on the outside no longer tells the whole story.

A recent study by independent researcher Eugen Spivak shifts the focus from the box to the individual items inside. The research asks a simple but difficult question: where does the evidence actually sit? Does the proof of a file's origin and its permissions live at the level of the entire collection, or is it recorded for each specific file? To answer this, the researcher examined twenty-nine public collections of data used in fields ranging from machine learning to digital preservation. These collections were chosen to represent different communities: those that compress data to save space, those that train artificial intelligence, and those that preserve digital formats for the long term. The study also reviewed seventeen different standards and frameworks—essentially the rulebooks and templates that researchers use to describe their data—to see what they are capable of recording.

The investigation revealed a significant gap between what is possible and what is actually happening. The rulebooks, known as metadata standards, are surprisingly capable. Many of them already have the technical ability to attach a specific permission, a source link, or a digital fingerprint to a single file. Some of these standards can even record a review of the file or a record of how it was created. However, the study found that almost no one is using these capabilities. In the twenty-nine collections examined, not a single one carried a permanent, unique identifier for the collection itself, a tool that would allow researchers to find the exact version of the data years later. Only five of the twenty-nine collections recorded a specific permission for each individual file. Most of the time, the permissions were either missing entirely, written in plain text that a computer cannot read, or applied to the whole collection regardless of the differences between the files inside.

The researcher also tested whether the tools designed to check these records actually work. Even when a file has a permission attached to it in a standard format, the software used to validate these records often ignores it. For example, one popular standard allows a file to have its own license, but the software that checks the file does not verify if that license is valid or even if it is a real license. It simply accepts whatever text is there. This creates a situation where the technology exists to solve the problem, but the tools that enforce the rules are not yet ready to use it. The study concluded that the missing piece is not a lack of vocabulary or capability in the standards, but a lack of adoption and a lack of reliable checking tools.

To demonstrate that a better system is possible, the researcher built a small, practical toolkit. This kit allows a builder to create a simple list for every file in a collection, noting its size, a unique digital fingerprint, its source, and its specific permissions. The kit then converts this list into a format that standard software can read. When tested on three different types of data collections, the kit successfully recorded what was known, what was unknown, and where the rules were conflicting. It showed that while the work requires effort, it is manageable. The cost is not in processing millions of files, but in the human time needed to gather the information for the different sources and transformations involved.

The findings suggest that the solution lies in a shift of perspective. Instead of hoping that a single label on a dataset covers everything, researchers need to record evidence at the level where the file is actually used. This means attaching a specific record to each file that travels with it, no matter where it goes. The study offers nine specific recommendations to make this happen. It calls on creators of data collections to publish a detailed list for every file they release. It asks the platforms that host these collections to stop overwriting the creators' records with their own generic summaries. It urges the maintainers of the technical standards to update their tools so they actually check for these file-level details. Finally, it asks reviewers of scientific papers to check for these five key pieces of evidence before accepting a study.

The path forward is clear but requires coordination. The technology to track every file's history and permissions already exists in the rulebooks. The challenge is to make sure that the people who build the data, the platforms that host it, and the tools that check it all agree to use it. By moving the evidence from the general description of a collection to the specific record of each file, the scientific community can ensure that the digital materials of today remain trustworthy, usable, and legally sound for the discoveries of tomorrow. The study does not claim to have solved the problem of data licensing, but it has mapped exactly where the evidence sits and shown that the gap is one of practice, not possibility.