In most cases a US company can license its own operational records to an AI lab. There is no federal law that bans it, Emory law professor Ifeoma Ajunwa told MIT Technology Review on Oct 13, 2026. What you can license is limited by your contracts, by state privacy law, by labor law and by what the records contain. The same article quoted Greg Ewing, a lawyer who advises AI startups, calling some of this data “legally radioactive.” The sections below explain how both can hold at once.
This is general information for US companies. It is not legal advice. Have your own counsel review any license before you sign it.
If you want a view of your data’s value before you spend on lawyers, get a confidential estimate.
Do you own the records you want to license?
Company records often hold other people’s information. Frankfurt Kurnit Klein & Selz (FKKS) lists the usual problems in its Oct 1, 2026 guide:
- Other companies’ confidential information covered by NDAs and commercial contracts.
- Licensed data, open-source and vendor code, and third-party material in attachments.
- Records generated by vendors that may claim rights in them.
Buyers check this. Collinear says it does not want data you do not hold the rights to (Collinear, observed Oct 16, 2026). The General Data Company takes customer or supplier records only where the company holds the rights and no confidentiality agreement stands in the way (Who Sells Data, Oct 14, 2026).
What do your software vendors allow?
Your records sit inside vendors’ systems, and their terms can limit use. FKKS points to Slack’s API terms, which “prohibit third-party application providers from using API data to train a large language model.” Read each vendor’s terms for export rights and AI-use limits before you promise a buyer anything. FKKS also advises checking what your vendors may do with your data if they are acquired, shut down or go bankrupt.
What do privacy laws require?
Your own privacy notices
You must honor the notices in effect when you collected the data. FKKS notes the FTC has warned that quietly adding uses such as AI training can be unfair or deceptive. For data already collected, consent is generally needed for a new use like this.
The CCPA
The California Consumer Privacy Act covers personal information of California employees, job applicants, contractors and business contacts. Licensing that information for value is a “sale” unless the data meets the CCPA’s de-identification standard. That standard requires technical measures, a public commitment not to re-identify and contract terms for recipients. A sale also brings notice, opt-out and risk-assessment duties (FKKS, Oct 1, 2026).
Sector and other laws
HIPAA, GLBA, children’s privacy, biometric and call-recording laws can apply depending on what the records hold. FKKS also lists GDPR for any EU personal data.
Training-data disclosure
California’s AB 2013 requires generative AI developers to disclose high-level information about their training data sources, including whether data was purchased or licensed (FKKS). Your deal may become visible in summary form.
What about employees?
Communications about pay, scheduling and working conditions can be protected concerted activity under Section 7 of the National Labor Relations Act, and licensing them could draw scrutiny. In a unionized workplace, the collective bargaining agreement may restrict a sale, and bargaining duties may apply (FKKS).
The Association of Flight Attendants-CWA objected to the sale of Spirit Airlines’ internal data to Google, and the bankruptcy court postponed the hearing (ch-aviation, Aug 24, 2026). Spirit’s pilots’ union and more than 120 lawmakers raised concerns later, and the hearing moved to Nov 6, 2026 (TravelPulse, Oct 10, 2026).
Can licensing waive privilege or trade-secret protection?
It can. FKKS warns that a sale may waive privilege over legal communications and weaken trade-secret protection for pricing logic, strategy documents and source code. Exclude your legal department’s files and anything you treat as a trade secret, or get specific advice first. Law firms have extra duties; see can a law firm license its data.
Does de-identification make it safe?
It lowers the privacy risk and leaves the rest. FKKS notes that stripping identifiers from large volumes of unstructured email and chat is difficult. Linked records can still reveal information about individuals or small groups. De-identification also does nothing about confidentiality you owe to customers and partners. For tax preparers it does not lift section 7216 either; see can an accounting firm sell its data to AI labs?
Buyers do the de-identification themselves, and their methods differ. Scale AI anonymizes inside your environment before extraction. Mercor uses an automated pipeline. Nyne AI and Collinear take the data first and anonymize on their side. Ask which model applies. Our guide on how to de-identify email and tickets before licensing explains how to check a buyer’s sample.
Can you take it back later?
Usually no. FKKS points out that once data is used in training it is practically impossible to remove, and models may reproduce parts of it. A buyer could also use your data to train a model that competes with you. Put deletion of raw data, a ban on re-identification and limits on field of use into the license.
A ten-step checklist before you sign
- List which systems and date ranges you would license.
- Confirm the company owns each set of records, and flag anything a customer, partner or vendor could claim.
- Read the export and AI-use terms of every vendor that holds the data.
- Check your privacy notices, employee handbooks and customer contracts for promises about data use.
- Identify California residents in the data and plan for CCPA notice and opt-out duties.
- Exclude HR, payroll, health, legal and trade-secret material.
- If you have a union, read the collective bargaining agreement and talk to counsel about bargaining duties.
- Ask the buyer how and where it de-identifies, and see a sample before signing.
- Put scope, field of use, deletion, no re-identification and payment milestones into the written license. Our guide to what’s in a data licensing agreement covers each clause.
- Get board or officer sign-off, and court approval if you are in bankruptcy.
Marin Data does not give legal advice. We check ownership and consent questions early and tell you where you need counsel. It costs you nothing.
Sources
- Frankfurt Kurnit Klein & Selz, selling company data for AI training, Oct 1, 2026
- MIT Technology Review, AI labs are buying data from dead startups, Oct 13, 2026
- ch-aviation, court delays Google acquisition of Spirit data, Aug 24, 2026
- TravelPulse, Spirit data sale delayed as lawmakers raise concerns, Oct 10, 2026
- Collinear, data acquisition, observed Oct 16, 2026
- Who Sells Data, buying programs, observed Oct 14, 2026
- Scale AI, Mercor, Nyne AI, observed Oct 16, 2026