Short answer
In the United States, a company can generally license data it owns to AI companies, and no single law bans it. Whether a specific dataset can be licensed depends on what it contains and on existing obligations: customer contracts, privacy notices, privacy laws such as the CCPA, sector rules such as HIPAA, and employment and labor law.
Licensing data your company owns is common practice, but common does not mean automatic. The honest answer to whether it is legal is that it depends on what is in the data and on what your company has already promised. This guide sets out the five checks that decide it. It is general information for US companies, not legal advice about your situation.
Key takeaways
- No single US law prohibits a company from licensing its own business data to AI buyers.
- Legality turns on five checks: contracts, privacy promises, privacy laws, sector rules and employment law.
- A transfer of personal information for payment can be a "sale" under California law unless the data is properly de-identified.
- Regulators have warned against quietly changing privacy terms to allow AI training on data already collected.
- Have your own attorney review the proposed agreement and your existing obligations before you sign.
The short answer
A company generally may license data it owns and has the right to share. The difficulty is that a company's systems hold much more than that. Email and chat contain other companies' confidential information. CRM records contain personal information. Some records are regulated. A deal is lawful when what is actually licensed clears each of the checks below, and when the license itself is properly written.
The five checks
| Check | The question | Where to look |
|---|---|---|
| 1. Contracts | Did we promise someone to keep this confidential? | Customer, vendor and partner agreements, NDAs |
| 2. Privacy promises | Does our stated policy allow this use? | Privacy policy, employee notices, handbook |
| 3. Privacy laws | Does a statute treat this as a regulated sale or use? | CCPA and other state laws, GDPR for non-US data |
| 4. Sector rules | Is any of it specially protected? | HIPAA, financial privacy rules, biometric and recording laws |
| 5. Employment and labor | Do employees have protected interests here? | Labor law, union agreements, workplace policies |
1. Contracts
Email and chat routinely contain information that customers, vendors and partners shared under an NDA or a confidentiality clause. Those promises still bind you. Platform terms matter too: some software vendors restrict what may be done with data taken from their tools. If your company processes data on behalf of customers, your data processing agreements probably limit you to providing the service.
2. Privacy promises
A company must honor the privacy statements that were in effect when it collected the data. Most privacy policies and employee handbooks were written before anyone thought of licensing workplace communications for AI training.
In February 2024, Federal Trade Commission staff warned that adopting more permissive data practices, such as using data for AI training, and telling people only through a quiet, retroactive change to terms may be unfair or deceptive. The practical reading: for data you already hold, you may need consent. For data you collect in future, you can update notices before you collect it.
3. Privacy laws
The United States has no single federal privacy statute covering all business data. State laws fill the gap, led by California.
The California Consumer Privacy Act applies to businesses above certain size thresholds. It covers personal information about California employees, job applicants, contractors and business contacts, not only consumers. Under the CCPA, transferring personal information for money or other valuable consideration is a "sale," which triggers notice and opt-out duties.
The main way out is de-identification. The CCPA treats information as deidentified only if the business takes reasonable measures so it cannot be linked to a person, publicly commits not to re-identify it, and contractually requires recipients to do the same. See de-identification for AI training data.
If your records include people outside the United States, GDPR or other national laws may apply, and they are generally stricter.
4. Sector rules
Some categories carry their own regimes: health information under HIPAA, customer financial information under federal financial privacy rules, children's data, biometric data under state laws, and recorded calls under consent laws. Legal and regulatory rules generally keep companies from licensing patient records, client-confidential files or personal data without the rights to do so. See what data can't be licensed for AI training.
5. Employment and labor
Workplace communications raise their own questions. Under the National Labor Relations Act, employee discussions of pay, scheduling and working conditions can be protected, in union and non-union workplaces alike. A collective bargaining agreement may restrict a deal or require bargaining. See employee privacy when a company licenses workplace data.
Three more issues lawyers raise
Privilege. Including communications with counsel can put attorney-client privilege at risk. Exclude them.
Trade secrets. Protection depends on secrecy. Licensing pricing logic, strategy or source code can weaken it.
Permanence. Once a model has been trained on data, the data cannot practically be taken back out. Decide carefully what goes in.
The buyer's disclosure duties affect you too
AI developers face their own transparency rules. California's AB 2013, in effect since January 1, 2026, requires developers of generative AI systems to publish a summary of their training data, including sources and whether data was purchased or licensed. The EU's AI Act contains similar requirements. A data license may not stay entirely private, so assume its existence could become known.
What a careful process looks like
A law firm that advises on these deals recommends, in summary:
- Involve legal, privacy, security, HR and communications, not business development alone.
- Do not share sample data before the review is done.
- Inventory data by system, record count and date range.
- Confirm your rights under customer, vendor and platform agreements.
- Exclude high-risk data entirely instead of relying on de-identification.
- Choose or approve the de-identification provider and method.
- Negotiate limits on the buyer's use, and who bears privacy risk.
- Document the review and the exclusions.
A prior data license will also come up if your company is ever acquired. Gaps in rights or notices can affect valuation, so keep a clean record.
How DataRelai's process fits
Any deal DataRelai helps arrange is a written license you review and sign, and it can require the buyer to anonymize and de-identify the data. We only work with buyers who do. We never take or handle your raw data, and nothing moves until you approve a deal. We are not a law firm and do not give legal advice. See if your company qualifies.
Frequently asked questions
Is it legal to sell employee emails and Slack messages to AI companies?
No US federal law bans it outright, but state privacy law, labor law, your contracts and your own notices can restrict it. Sensitive categories should be excluded and the rest de-identified.
Do we need our customers' consent?
It depends on your contracts and on what the data contains. Where a contract requires confidentiality, you may need the customer's permission or must exclude their information.
Does de-identifying the data make the deal legal?
Not by itself. De-identification addresses privacy law. It does not cancel confidentiality clauses, privilege or platform restrictions.
Is it legal for a company that is shutting down?
Data has been sold in wind-downs and bankruptcies, including one airline's archive in 2026. The same obligations to customers and employees still apply, and that sale drew objections from a union.
Sources
- Frankfurt Kurnit Klein & Selz, "Selling Company Data for AI Training: What to Know Before You Say Yes" (October 1, 2026)
- Crowell & Moring, "Again, AI Does Not Change The Law: FTC Guidance on Unfair and Deceptive Practices Involving Privacy Policies" (February 2024)
- Jones Day, "California Bill Will Require Disclosures About Data Used in Training AI Models" (September 2025)
This guide is general information, not legal, tax or financial advice. Whether a particular dataset can be licensed depends on what it contains and on obligations your company already has.