Is selling company data to AI labs legal? US rules explained
It can be, if the data is yours to license and properly de-identified. California and similar state laws require reasonable de-identification measures, a public commitment not to re-identify, and contracts binding every buyer. Your customer contracts, privacy promises, employee notices, software terms and sector laws such as HIPAA also apply.
The three-step test for de-identified data
Under the California Consumer Privacy Act, information counts as de-identified only if it cannot reasonably be linked to a person and the business holding it does three things: "Takes reasonable measures to ensure that the information cannot be associated with a consumer or household", publicly commits not to re-identify it, and "Contractually obligates any recipients" to comply.
| State | Law | Same three steps? | Employees covered? |
|---|---|---|---|
| California | Civil Code 1798.140(m) | Yes | Yes, since January 2023 |
| Virginia | Code 59.1-581 | Yes | No: excludes the employment context |
| Texas | Business and Commerce Code 541.106 | Yes | No: excludes the employment context |
| Oregon | ORS 646A.583 | Yes | No: excludes the employment context |
Data that meets the test falls outside these laws' rules on selling personal information. Data that doesn't is still personal information, and licensing it can count as a sale.
Employees' messages
California's temporary exemption for employee and business-contact data expired on 31 December 2022, so staff messages are covered there like any other personal information. Most other state laws define a consumer to exclude people acting in a commercial or employment context.
Other rules can still apply. A law firm briefing notes that discussions among employees about pay and working conditions can be protected under federal labour law, and that union agreements may limit how such data is used.
Your own promises
The FTC has warned that "It may be unfair or deceptive for a company to adopt more permissive data practices" after the fact, and that a business "cannot then unilaterally renege" on the privacy commitments it collected data under. Read your privacy notice, customer terms and employee handbook before you plan a licence.
Calling data anonymous is a claim you can be held to. In 2024 the FTC ordered Avast to pay $16.5 million after it sold browsing data it had said would only be shared in "aggregate and anonymous form". In the FTC's words, "re-identification gets easier every day".
Client data, contracts and software terms
- Data you hold for clients is normally theirs. Customer contracts and confidentiality agreements often bar other uses.
- Vendors may claim parts of the data: in the Spirit Airlines case, a software vendor objected to the sale of some records.
- Software terms matter. Slack's API terms ban using its API data to train large language models, and Google's Workspace API policy bans transfers for general AI models. See can you sell Slack data.
- Privileged legal advice and trade secrets can lose protection once shared.
Sector laws that add rules
| Law | When it applies | What it requires |
|---|---|---|
| HIPAA | Health records held by health providers, plans or their business associates | De-identification by Safe Harbor (18 identifier types removed) or a documented expert determination |
| GLBA | Banks and other financial institutions | Limits on sharing customers' nonpublic personal information |
| FERPA | Education records | Removal of identifying information and a reasoned judgement that students can't be identified |
| Illinois BIPA | Biometric data, such as voiceprints or face scans | A ban on selling or profiting from biometric identifiers |
California's data broker law covers businesses that sell personal information about people they have no direct relationship with. Properly de-identified data is not personal information, which is one more reason to document how it was prepared.
How ready is your legal position? Tick what is done
Tick everything that is true. Your result appears here, and changes as you go.
How to read this
- Start with the basics: Read your own promises and contracts first. They decide what is possible.
- Getting there: Close the open items before any data is exported or shown to a buyer.
- Ready for the next step: You are ready to plan de-identification. See how to de-identify company data.
This guide is general information, not legal advice. Every licence needs its own legal review.
Questions
Is it legal to sell company data to AI companies?
It can be, when the data is yours, properly de-identified and allowed by your contracts, privacy promises and software terms. Sector laws such as HIPAA add rules.
What does de-identified mean under the CCPA?
Data that can't reasonably be linked to a person, where the business takes reasonable measures, publicly commits not to re-identify it, and binds every recipient by contract.
Do I need employee consent to sell company emails?
It depends on the state and your own promises. California's privacy law has covered employees since 2023; most other state laws exclude them. Labour law and union agreements can also apply.
Can I sell data that includes my customers' messages?
Only if your contracts and privacy notice allow it and it is properly de-identified. Data you hold for clients is usually theirs.
Is licensing data the same as being a data broker?
Not usually. California's data broker law covers selling personal information about people you have no direct relationship with, and properly de-identified data is not personal information.
Sources
- California Consumer Privacy Act text, section 1798.140(m) California Privacy Protection Agency
- California Consumer Privacy Act: frequently asked questions California Department of Justice
- Code of Virginia, section 59.1-581 Virginia Division of Legislative Services
- Texas Data Privacy and Security Act (HB 4, enrolled) Texas Legislature
- ORS 646A.583, de-identified data Oregon Revised Statutes, via Oregon Public Law
- AI (and other) companies: quietly changing your terms of service could be unfair or deceptive (13 February 2024) US Federal Trade Commission
- FTC order on Avast's sale of browsing data (22 February 2024) US Federal Trade Commission
- FTC cracks down on mass data collectors (4 March 2024) US Federal Trade Commission
- Selling company data for AI training: what to know before you say yes (1 October 2026) Frankfurt Kurnit Klein & Selz, law firm
- 45 CFR 164.514, de-identification of protected health information Legal Information Institute, Cornell Law School
- California Delete Act, data broker definitions (effective 2026) California Privacy Protection Agency