Is it legal to sell company data to AI labs?

1. Who can sign?

Confirm who controls the data today: the board, a founder with authority, or — after a shutdown — a trustee, assignee or asset buyer. Proceeds usually go to the company and then to creditors and investors.

2. Other companies' confidential information

Customer and partner data covered by NDAs or contracts usually cannot be licensed without consent. Exclude it.

3. Platform terms

Slack's API terms bar using data obtained through its API to train large language models, so how the data is exported matters. Check the terms of every tool you plan to include.

4. Privacy law

• Privacy notices: what you told employees and customers when you collected the data still applies. Quietly changing it can be deceptive.
• CCPA (California): transferring personal information for value can count as a “sale” unless it is properly de-identified.
• GDPR (EU/UK): purpose limitation means data collected to run the business may not be reusable for AI training without a valid basis.

5. Employee communications

In the US, employee discussions about pay and working conditions have legal protection, and union agreements may apply. Many sellers exclude HR, legal, health and union-related data entirely.

6. De-identification

Ask who removes personal data, to what standard, and when raw copies are deleted. Sellers do best when they pick or approve the de-identification vendor.

Questions to ask any buyer

• Is the license exclusive, and for how long?
• Exactly which systems, date ranges and folders are in scope?
• Who de-identifies the data, and when is the raw data deleted?
• When and how is payment made — upfront, in milestones, or on acceptance?
• What warranties and indemnities are you asking us to give?

Checklist to take to counsel

Bring this list to the lawyer who will read the agreement. It follows the points in the Frankfurt Kurnit note, which is where the structure comes from.

• Right to sell. Does any customer or partner contract make the records confidential? Do the platforms' API terms limit using exported data to train models? Could any of it be privileged, or a trade secret you would lose by sharing?
• Old privacy promises. What did your privacy notices and customer terms say when you collected the data, and does a sale to an AI lab fit within them?
• Employee handbook and NLRA section 7. What did you tell staff about monitoring and use of their messages, and do the records include discussion of pay or working conditions?
• CCPA. Would the transfer count as a “sale” of personal information, and does the de-identification meet the statute's standard?
• GDPR and UK GDPR. Which lawful basis covers this new purpose, and is there a processor agreement under Article 28 with whoever handles the records?
• High-risk categories. Which categories will you exclude outright (HR, legal, health, payment data, minors) instead of relying on scrubbing?
• Deal terms. Exclusivity and length, scope of use, sub-licensing, deletion of raw copies, warranties and liability caps.

Compare buyers →