In the US, licensing your company's records to an AI company is generally legal if the company owns them, no contract forbids the use, and personal information is removed or handled as privacy law requires. No federal law bans these sales, an Emory University law professor told MIT Technology Review (October 2026), but state laws such as California's CCPA, the EU's GDPR and your own contracts still apply. This page is general information, not legal advice.
On this page
Data Licensors, the company that publishes this page, also licenses company records, and we go through a rights check with every owner before signing.
Who owns the company's records?
The company does, not the people who wrote them. Lawyers told Business Insider that work data is generally not private and belongs to the company (Business Insider, October 5, 2026). Two practical rules follow:
- Employees cannot sell employer data. Code and records made for an employer belong to the employer, and the buyer checks before anything moves (aitrainer.work, checked October 2026). Former Mercor contractors allege in a lawsuit that the company encouraged them to upload work materials without their employers' consent; Mercor has denied the claims in court (Business Insider, October 13, 2026).
- The right person must sign. For a running company that is the owner or the board. For a closed company it can be co-founders, investors, a liquidator, an assignee or a bankruptcy trustee. See selling startup data before shutdown.
Can I license records that involve my clients?
This is the most common blocker. Polyshares notes that material governed by a client master agreement belongs to the client regardless of value. Nyne puts it this way: being able to export a record does not by itself give you permission to license it (both checked October 2026). Check:
- Master service agreements and statements of work for confidentiality, ownership of deliverables, and "use of client data" clauses.
- NDAs with customers, suppliers and partners.
- Platform terms for any data a vendor holds on your behalf.
Vendors may see your records as partly theirs. The head of Springshot, a longtime Spirit Airlines software vendor, told Business Insider he had "less than 48 hours' notice, from the media" that intellectual property his company had spent 15 years building could be part of the airline's data sale (Business Insider, October 13, 2026). When in doubt, leave that material out or ask.
Is employee information a problem?
It can be, and it is the area under the most public scrutiny. Emails and chats hold personal details: Greg Ewing, an attorney who advises AI startups, told MIT Technology Review (October 2026) about doctor appointments, school pickups and date-night plans hidden in calendars and inboxes. The same article quoted the Emory professor, Ifeoma Ajunwa, saying "employers should have express consent before selling workers' data," while noting no federal law bans such sales.
The Spirit Airlines case shows the scrutiny. Google won the August 2026 bankruptcy auction for Spirit's business records with a $10 million bid (Axios, August 2026). Unions representing Spirit flight attendants and pilots objected on privacy grounds (Business Insider, October 5, 2026). More than 120 members of Congress asked Google and Spirit to exclude employee information where possible and to get employee approval of the de-identification protocol, and the court hearing on the sale was moved from October 14 to November 6, 2026 (TravelPulse, October 2026). The sale is not final.
State law can cover staff too. California's CCPA has applied to employee and job-applicant personal information since its employee exemption expired on January 1, 2023 (Holland & Knight, December 2022). The CCPA only reaches for-profit businesses that do business in California and meet one of three tests: more than $25 million in annual gross revenue (adjusted for inflation), buying, selling or sharing the personal information of 100,000 or more consumers or households a year, or earning half or more of revenue from selling or sharing personal information (Cal. Civ. Code 1798.140(d)). Other states have their own rules, so check where your staff live.
Practical steps:
- Leave out HR, payroll, benefits, medical and performance records.
- Leave out private channels and direct messages unless you have a clear reason and a policy that covers them.
- Make sure names, contact details and IDs are replaced before any record leaves.
- Tell your team. We recommend doing it before any records are shared, and we provide a plain-language note owners can send (Data Licensors, October 2026).
What about customer personal data?
Leave consumer personal data out. Most buyers will not take it. Endless lists customer, employee and client personal data among the things that stay with you. micro1's published terms make the company licensing the data promise it contains no HIPAA protected health information, biometric data, payment card or bank account data, or children's data, unless an order form says otherwise (both checked October 2026). We do not accept consumer personal data collected for other purposes, such as customer lists (Data Licensors, October 2026).
Business customers' names and contacts inside emails and tickets are usually replaced with placeholders such as [Customer] during de-identification. In a bankruptcy, US law adds a check: a court-appointed consumer privacy ombudsman reviewed the Spirit sale, passenger databases were excluded, and she recommended approval. Her review did not cover employee privacy (Business Insider, October 5, 2026).
How do GDPR and CCPA treat de-identified data?
The two laws draw the line differently, so it matters which applies.
- GDPR (EU staff or customers; the UK has its own near-identical version). Truly anonymous information is outside the GDPR, but pseudonymised data, where a person can still be re-linked with extra information, remains personal data (GDPR Recital 26). The European Data Protection Board said in December 2024 that AI models trained on personal data cannot always be considered anonymous and must be assessed case by case. Its draft anonymisation guidelines of July 2026 add that anonymising is itself processing that must comply with the GDPR, including having a legal basis, and that data can be personal for one party and anonymous for another (DLA Piper, August 2026).
- CCPA (California). "Deidentified" means information that cannot reasonably be linked to a particular consumer, where the business holding it takes reasonable measures to prevent that, publicly commits not to re-identify it, and contractually binds any recipient to the same rules (Cal. Civ. Code 1798.140(m), text effective July 15, 2024). The Spirit sale agreement required the de-identification to be certified against the CCPA standard (see how de-identification works).
If you have staff or customers in the EU or UK, get advice before including their records. Some buyers focus on the US anyway: micro1, for example, says it currently prioritizes US companies (checked October 2026).
What should I leave out?
| Leave out | Why |
|---|---|
| Health and medical information | Regulated, and excluded by most buyers |
| Payment card, bank and government ID numbers | Regulated, and excluded in buyer terms |
| HR, payroll, benefits and performance files | Sensitive employee data, high scrutiny |
| Privileged legal material | AfterQuery and Endless say they never use it |
| Client work under a restrictive contract | Not yours to license |
| Passwords, keys and tokens | Security risk, removed in any case |
| Children's data | Excluded in micro1's terms |
| Consumer marketing lists | Personal data collected for another purpose |
What should the agreement say to protect me?
Your contract should make the buyer finish de-identification before any onward transfer, forbid re-identification and resale, limit use to training and testing, set deletion dates, and cap your liability. Expect to promise that you have the rights you are granting, so check those first. Our data licensing agreement guide explains each term.
How do I tell my team?
Be direct and early. Explain what is included, what is left out, how names and personal details are removed, who will receive the records, and that no one's personal messages or HR files are part of it. Offer a contact for questions, and say that anyone can ask for a specific person, project or topic to be left out. Raise any contract or privacy limits with a buyer on the first call; nothing is licensed until you sign.
