Is it legal to sell company data to AI?

TL;DR

• The US has no general federal ban. Emory law professor Ifeoma Ajunwa says employers should have express consent before selling workers' data, but adds, MIT Technology Review reports, that no federal law bans such sales (MIT Technology Review, Oct 13 2026).
• Platform terms can bind the data. Slack's API terms bar an app offered outside your organisation from using API data "to train a large language model" (Slack API Terms, effective Oct 10 2025).
• Anonymous information falls outside the GDPR, but pseudonymised data is still personal data (GDPR Recital 26).
• Biometric data used to identify people is a special category under the GDPR (Article 9), and Illinois bars any private entity from selling or profiting from biometric identifiers, including face geometry (740 ILCS 14/15).
• US health data counts as de-identified under HIPAA only after an expert determination, or after 18 listed identifiers are removed, including full-face photographs (45 CFR 164.514).
• A dissolved Delaware corporation continues for 3 years in order to "dispose of and convey their property" (8 Del. C. § 278). A dissolved UK company's property passes to the Crown (Companies Act 2006, s. 1012).
• Buyers push the risk onto the seller. micro1's public master terms make the seller warrant its consents and releases, and that the data was not scraped (micro1).

This guide is general information, not legal advice. Law differs by country, state and data type, so have counsel in your jurisdiction review any specific license.

Is it legal for a company to sell its data to AI companies?

In most cases yes: licensing data a company owns is an ordinary commercial contract. The answer turns on four gates, and a deal has to clear all of them:

1. Ownership. Does the company own the data, or only hold it for someone else?
2. Contracts and platform terms. Does any agreement forbid this use?
3. Personal data. Whose personal data is inside, and is there a lawful basis to re-use it, or can it be de-identified?
4. Corporate status. Does the company still exist in law, and who can sign for it?

For the commercial side, see how to sell data to AI companies.

Does the company own the data, or only hold it?

The first question is ownership, because a company can only license rights it has. Three situations cause most problems.

• Work made by employees. In the US, the employer is the author and owner of copyright in a work made for hire, unless a signed written agreement says otherwise (17 U.S.C. § 201(b)). Drawings, code and documents staff produced on the job are usually the company's.
• Work made for clients. Footage shot for a client, scans commissioned by a building owner and designs delivered under contract may belong to the client, or come with use limits. The engagement contract decides.
• Data held for customers. If your company processes personal data on behalf of customers, the GDPR says a processor acts "only on documented instructions from the controller" (GDPR Article 28(3)(a)). A software provider cannot license its customers' records as its own.

Archives also hold other companies' material. When Spirit Airlines' records were put up for sale in its bankruptcy, the head of Springshot, a longtime Spirit vendor, said he learned from the media, with less than 48 hours' notice, that intellectual property his company spent 15 years building could be given away (Business Insider, Oct 13 2026). Vendor files, partner documents and licensed content should come out of scope.

Do contracts or platform terms stop you from licensing data?

They can, so read three kinds of agreement before anything else: customer contracts, supplier and data licenses, and the terms of the software the data sits in.

• Customer and partner contracts. Confidentiality clauses, NDAs and data processing agreements often limit what you can do with information received under them, whatever privacy law says.
• Data you licensed in. Market data, stock media and third-party datasets can come with terms that limit or forbid sublicensing, so check each license before including the data.
• Software terms. Slack's API terms say an app "offered for use outside your organization" may not "use API Data to train a large language model" or "bulk export Slack message and file data" without an additional agreement (Slack API Terms). Those words bind app providers; read your own Slack agreement before exporting.

Much company data already sits in third-party software, so licensing it is a re-licensing, and the software terms are part of the chain of rights.

Do employees or customers have to consent?

Not always by law, but often in practice. In the US, Ajunwa told Business Insider that the lack of federal privacy laws leaves few legal barriers to using employee data for AI training, and that whether employees' consent "actually extend[s] to the sale of the data" is "an ethically gray area". For customer data, state privacy laws are the main exception. California's CCPA is one example: "sell" covers making a consumer's personal information available to a third party "for monetary or other valuable consideration" (Cal. Civ. Code § 1798.140(ad)), which brings opt-out rights with it. Other states have passed comprehensive privacy laws of their own (IAPP state privacy legislation tracker), so check the law in each state your customers are in.

In the EU and the UK, personal data must be collected for specified purposes and "not further processed in a manner that is incompatible with those purposes" (GDPR Article 5(1)(b)). Article 6(4) sets out how to test whether a new purpose, such as AI training, is compatible (GDPR Article 6). For AI models specifically, the European Data Protection Board applies a three-step legitimate-interest test (a lawful interest, necessity and a balancing test) and stresses people's reasonable expectations (EDPB Opinion 28/2024).

Two practical rules follow. First, the company licenses, not individual staff: former Mercor contractors allege in an ongoing lawsuit that they were encouraged to upload work materials without their employers' consent, which Mercor denies (Business Insider). Second, the less personal data a license contains, the smaller the consent question.

When is personal data de-identified enough to license?

Data is de-identified enough when no one, using means reasonably likely to be used, can tell who it is about. Removing names alone does not meet that bar. Under the GDPR, data that "could be attributed to a natural person by the use of additional information" is pseudonymised and still personal data, while truly anonymous information is outside the regulation (Recital 26). Each region phrases the test differently:

• EU. The EDPB published draft anonymisation guidelines (02/2026) for public consultation on July 8 2026.
• UK. The ICO's anonymisation guidance asks whether a "motivated intruder" could re-identify people.
• Australia. The OAIC treats information as de-identified when the risk of re-identification is very low in the context where it is released (OAIC).
• California. "Deidentified" requires reasonable measures against re-association, a public commitment not to re-identify, and a contract binding every recipient to the same (§ 1798.140(m)).
• US health data. HIPAA allows de-identification by expert determination, or by removing 18 identifiers, among them biometric identifiers and full-face photographs (45 CFR 164.514(b)).

Because the risk depends on who receives the data, licenses for de-identified data commonly ban re-identification by contract (see the agreement guide).

Can you license video that shows people?

Yes, but footage of identifiable people is personal data, so it needs either a lawful basis for the new use or faces, license plates and other identifiers removed first. The EDPB's video guidelines say recordings from high altitude fall under the GDPR only if the data can be related to a specific person, and that a car's parking camera falls outside the GDPR only if it collects nothing that relates to a person, such as license plates or details that could identify passers-by (EDPB Guidelines 3/2019). The same guidelines note that a third party receiving footage has to identify its own legal basis.

Faces raise a second question. Under the GDPR, photographs count as biometric data only when processed "through a specific technical means" that identifies a person (Recital 51; Article 4(14)). Illinois' BIPA covers a "scan of hand or face geometry" but not photographs as such, bars selling or profiting from biometric identifiers, and sets liquidated damages of $1,000 per negligent and $5,000 per intentional or reckless violation (740 ILCS 14).

In practice footage falls into three groups:

• Little or no personal data: cameras fixed on machines or on empty work cells, high-altitude survey footage. Robot views in shared spaces often show people, so check them like site cameras.
• People in the frame: dashcams, site and store cameras. Faces and plates need removing or blurring.
• People as the subject: body-worn cameras and procedure video. These need the strongest basis, often notice or consent.

The data-type pages cover each case: egocentric video, dashcam and fleet video and drone and aerial footage.

Can a closed or bankrupt company still sell its data?

Often yes, within limits set by company and insolvency law. A dissolved Delaware corporation continues for 3 years (or longer if the Court of Chancery directs) "to dispose of and convey their property" (8 Del. C. § 278). In the UK, the property of a dissolved company is "deemed to be bona vacantia" and belongs to the Crown (Companies Act 2006, s. 1012), so a UK company should license its data before it is struck off, not after.

In a US bankruptcy, a debtor whose privacy policy prohibited transferring personal information can sell it only if the sale is consistent with that policy, or if the court approves it after a consumer privacy ombudsman is appointed (11 U.S.C. § 363(b)(1)). In the Spirit Airlines sale process, customer profiles are excluded, passenger fields must be de-identified, and a court-appointed privacy watchdog was reviewing the proposed purchase as of September 2026 (Fortune, Sep 14 2026). Proceeds from wind-down sales typically go to senior creditors and investors (MIT Technology Review).

For shut-down robotics companies, see robot and teleoperation data.

Which privacy law applies in each region?

The law where your company is established applies, and often the law where the people in the data are as well: the GDPR, for example, also covers companies outside the EU that offer goods or services to people in the EU or monitor their behaviour there (GDPR Article 3(2)). Check every region your data touches.

Region	Main law	Point to check before licensing
US	No general federal privacy law; state comprehensive privacy laws such as the CCPA, sector laws such as HIPAA, biometric laws such as BIPA	Whether the license is a "sale" of personal information, and whether any health or biometric data is inside
EU	GDPR	Purpose compatibility, legal basis, special-category data, and transfer clauses for buyers outside the EEA
UK	UK GDPR and the Data Protection Act 2018	The ICO's anonymisation guidance and the motivated-intruder test
Canada	PIPEDA and provincial laws	Whether the original consent covers the new use
Australia	Privacy Act 1988	The OAIC's de-identification test for the release context
New Zealand	Privacy Act 2020	The disclosure limits in the information privacy principles
Japan	Act on the Protection of Personal Information	Its separate rules for anonymously processed information

What will an AI buyer make you promise?

A buyer will make you promise, in writing, that you had the right to collect and license everything you deliver, and will make you pay if that turns out to be wrong. micro1's public master terms are a good example. The seller warrants that it has "obtained all consents, opt-ins or other valid legal bases" required by privacy law, has the releases needed for anyone whose likeness appears, and did not scrape or harvest the data from online sources without the owner's authorization (micro1). The seller indemnifies the buyer against third-party claims that the data breaches privacy, publicity or intellectual property rights (micro1, s. 8.1).

Buyers have reasons of their own to ask. In the EU, providers of general-purpose AI models must publish "a sufficiently detailed summary about the content used for training" and keep a copyright compliance policy (AI Act, Article 53). Clean provenance on your side makes your data easier to buy.

If your data clears these gates, or you are not sure yet, talk to our team. The contract terms are in the agreement guide, and the sell hub shows what each data type needs.