# Can you license your company's GitLab projects to AI companies?

URL: https://sellmydatatoai.net/data-rights/gitlab
Reviewed: 2026-11-08
Covers: GitLab.com, GitLab Self-Managed and GitLab Dedicated projects

Section 8.4 of the GitLab Subscription Agreement says the customer keeps "all right, title, and interest in and to, Customer Content," and we found no clause stopping you licensing your own repositories for AI training. GitLab Duo output is different: the Duo terms bar using AI Functionality to train a competing model. Confirm your position with your own counsel before licensing any project.

## GitLab data rights at a glance

| Data available | Export method | Plan needed | AI-training restriction in the terms |
| --- | --- | --- | --- |
| Repository, wiki, issues and merge requests | Project file export | Free, Premium or Ultimate, Maintainer or Owner role | No: no AI clause found. Subscription Agreement §8.4 keeps Customer Content with you |
| Git history only | git clone or mirror | Any tier, read access | No: no AI clause found |
| GitLab Duo inputs and outputs | Not a separate export | Tiers with GitLab Duo | Yes: Duo AI Terms §3.3: "will not use AI Functionality to create, train, or improve" a competing model |

## Who owns your GitLab content under GitLab's terms?

Your company owns its GitLab content. Section 8.4 of the [GitLab Subscription Agreement](https://handbook.gitlab.com/handbook/legal/subscription-agreement/) (version 8, last modified February 5, 2026) says the customer will "retain all right, title, and interest in and to, Customer Content," subject to a limited license GitLab needs to provide and improve the software.

Section 1 defines Customer Content as "all software, information, content and data provided by or on behalf of Customer." Section 5.1 bars using the software to "build a competitive product or service," which targets GitLab's product rather than your code.

Ownership against GitLab is settled. Our guide on [whether you can legally sell company data](https://sellmydatatoai.net/guides/can-you-legally-sell-company-data-for-ai) covers the other rights holders in your code.

## What can you export from GitLab, and how?

GitLab's project file export packages a project and its history. The [import and export documentation](https://docs.gitlab.com/user/project/settings/import_export/) lists what goes in:

- Project and wiki repositories, uploads, LFS objects and design files
- Issues with comments, merge requests with diffs and comments, labels, milestones, snippets and releases
- Not included: CI/CD variables, job logs and artifacts, encrypted tokens, webhooks, secure files and registry images
- A worker deletes export files every 24 hours, and default rate limits allow 6 exports per minute

Keep merge request discussions linked to the commits they reviewed. Buyers of [source code datasets](https://sellmydatatoai.net/buy-ai-training-data/source-code-datasets) look for that context.

## Do GitLab's terms restrict AI training on your code?

GitLab's terms do not restrict AI training on your own content, based on the documents we reviewed. The Subscription Agreement contains no AI-training clause on Customer Content.

GitLab Duo has its own terms. The [GitLab Duo AI Terms](https://handbook.gitlab.com/handbook/legal/ai-functionality-terms/) (last modified November 13, 2025) say in section 2.4 that "both Input and Output constitute additional Customer Content," so you own Duo output too. Section 3.3 then says the customer "will not use AI Functionality to create, train, or improve (directly or indirectly)" a competing model.

Whether licensing Duo-generated code or summaries to an AI lab counts as indirect use of AI Functionality to train a competing model is **unclear**. Identify Duo output in your projects and treat it as a separate category for counsel to review.

## Which GitLab tier and roles do you need?

You need the Maintainer or Owner role on each project. Project export is available on Free, Premium and Ultimate, on GitLab.com, GitLab Self-Managed and GitLab Dedicated.

- Maintainer or Owner role per project
- Download each export within 24 hours
- GitLab Dedicated customers must migrate Customer Content themselves at termination, under Appendix 2 of the agreement

## What personal data is in a GitLab export?

Commit authors, email addresses, issue comments, assignee names and merge request reviews identify your engineers. Issue trackers used for customer support may also hold customer names and account details.

### The US position

In the US, start with California. The CCPA defines a sale as making personal information available "for monetary or other valuable consideration" (Cal. Civ. Code § 1798.140(ad)(1)), and a license fee from an AI buyer fits that wording on its face. Employee and business-contact data have been in scope since January 1, 2023, when the temporary exemptions expired.

Data counts as deidentified under § 1798.140(m) only if you take reasonable measures so it "cannot be associated" with a person, publicly commit to keep it that way and contractually bind every recipient. Our [de-identification guide](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data) explains how to meet that standard, and our [guide to the CCPA and state privacy laws](https://sellmydatatoai.net/guides/gdpr-and-selling-data-for-ai-training) covers the other states.

Other comprehensive state privacy laws, including those in Virginia, Colorado and Texas, define sales and exemptions in their own words, and several treat employee data differently from California. Map where the people in your export live before you rely on any one state's rules.

If the export could hold health information from a HIPAA covered entity or business associate, HHS recognizes two de-identification methods under 45 CFR 164.514(b): Expert Determination, and Safe Harbor, which removes 18 types of identifiers. Financial institutions under the Gramm-Leach-Bliley Act must explain customers' right to opt out of certain sharing with nonaffiliated third parties, according to the FTC.

Your own privacy promises still bind you. FTC staff wrote on February 13, 2024 that adopting more permissive data uses, such as AI training, through a "surreptitious, retroactive amendment" to terms or a privacy policy could be unfair or deceptive. Check the privacy notice, employee handbook and customer contracts in force when the data was collected.

### If you hold UK or EU data

UK GDPR and EU GDPR treat names, email addresses and message content about identifiable people as personal data. Licensing it for AI training is a new purpose, so you need a lawful basis under Article 6 and a compatibility assessment under Article 6(4), which the ICO covers in its guidance on compatibility and the reuse of personal information. This page is general information, so confirm your position with your own counsel.

## What third-party content is in a GitLab export?

GitLab projects pull in open-source dependencies, forks and contractor code. Each keeps its own license or contract terms, so record them and exclude what you cannot clear.

Our guide to [selling source code to AI companies](https://sellmydatatoai.net/guides/sell-source-code-to-ai-companies) sets out the review buyers expect.

## How do you prepare a licensable GitLab export?

Preparing a GitLab export for a buyer starts with the extraction route and ends with a manifest. Work through these steps in order.

1. **Export each project within its window**: Run project exports with the right role, download within 24 hours and check that each archive opens.
2. **Document what the export leaves out**: Note that CI/CD variables, job logs and artifacts are excluded, and export pipeline configuration from the repository if a buyer needs it.
3. **Flag GitLab Duo output**: Identify code and text produced with GitLab Duo and hold it back until counsel reviews section 3.3 of the Duo terms.
4. **Remove third-party content**: Take out client code, dependencies with incompatible licenses and contractor work without an IP assignment unless the other party has agreed in writing, and keep privileged legal material out entirely.
5. **De-identify and test**: Replace names, user IDs and email addresses across the GitLab export, then run a re-identification test on a random sample, as our [de-identification guide](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data) describes.
6. **Write the manifest**: Record record counts, date ranges, systems, exclusions and the export method in a [data manifest](https://sellmydatatoai.net/guides/how-to-build-a-data-manifest) that matches what you deliver.
7. **Get counsel's sign-off**: Ask your own counsel to review the GitLab terms, your order form and your privacy notices together before any buyer sees a sample.

If you want a view on whether your GitLab data is licensable and what buyers might pay, start with a [data valuation](https://sellmydatatoai.net/data-valuation). We are a broker, not a law firm, so take independent legal advice before you sign any license.

## Frequently asked questions

### Does a GitLab project export include merge request comments?

Yes. GitLab's documentation says the project file export includes issues and their comments, merge requests with diffs and comments, commit comments, labels, milestones, snippets, releases and design files, alongside the project and wiki repositories. It leaves out CI/CD variables, job logs and artifacts, encrypted tokens, webhooks and registry images. Export files are deleted every 24 hours, so download promptly.

### Can I include GitLab Duo-generated code in an AI training license?

It is unclear. The GitLab Duo AI Terms say Duo inputs and outputs are Customer Content you own, but section 3.3 says you will not use AI Functionality to create, train or improve a competing model, directly or indirectly. Licensing Duo output to an AI lab could be read as indirect use. Identify Duo output in your projects and ask your own counsel before including it.

### Does GitLab claim rights in my repositories?

Only a limited license. Section 8.4 of the GitLab Subscription Agreement says the customer retains all right, title and interest in Customer Content, subject to a limited license GitLab needs to provide, develop and improve the software. Customer Content covers all software, information, content and data provided by or for the customer.

### Why are CI/CD variables missing from my GitLab export?

GitLab excludes them by design. Its documentation lists CI/CD variables, pipeline schedule variables, job logs and artifacts, encrypted tokens, webhooks, secure files and deploy keys among the items a project export leaves out. For a licensing dataset that is useful, since those items often hold secrets. Document the exclusions in your manifest so buyers know what to expect.

## Sources

- [GitLab Subscription Agreement](https://handbook.gitlab.com/handbook/legal/subscription-agreement/), GitLab Handbook, accessed November 2026
- [GitLab Duo AI Terms (Additional Terms)](https://handbook.gitlab.com/handbook/legal/ai-functionality-terms/), GitLab Handbook, accessed November 2026
- [Migrating projects and groups by using file exports](https://docs.gitlab.com/user/project/settings/import_export/), GitLab Docs, accessed November 2026
- [California Consumer Privacy Act of 2018, Civil Code section 1798.140](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf), California Privacy Protection Agency, accessed November 2026
- [California Consumer Privacy Act employee and B2B exemptions expire January 1, 2023](https://www.morganlewis.com/pubs/2022/10/california-consumer-privacy-act-employee-and-b2b-exemptions-expire-january-1-2023), Morgan Lewis, accessed November 2026
- [AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive), Federal Trade Commission, accessed November 2026
- [Guidance Regarding Methods for De-identification of Protected Health Information](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), U.S. Department of Health and Human Services, accessed November 2026
- [Gramm-Leach-Bliley Act](https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act), Federal Trade Commission, accessed November 2026
- [Compatibility and the reuse of personal information](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/compatibility-and-the-reuse-of-personal-information/), Information Commissioner's Office, accessed November 2026
- [Regulation (EU) 2016/679 (General Data Protection Regulation)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), EUR-Lex, accessed November 2026

---

Get a data valuation: https://sellmydatatoai.net/data-valuation