Can you license your company's Google Workspace data to AI companies?

Google Workspace data rights at a glance

Who owns your Google Workspace data under Google's terms?

Your company keeps the intellectual property in its Google Workspace data. Section 5.1 of the Google Workspace terms (last modified October 12, 2026) says "Customer retains all Intellectual Property Rights in Customer Data," and section 14.19 defines Customer Data as "data submitted, stored, sent or received via the Services."

Section 5.2 limits Google to processing Customer Data to provide the services and says Google "will not access, use, or process Customer Data for any other purpose." The customer restrictions in section 3.3 cover copying and reselling the services, not reusing your own data.

That settles ownership against Google. Whether you may license email written by customers and candidates is a separate question, covered in our guide on whether you can legally sell company data.

What can you export from Google Workspace, and how?

A super admin can export the whole domain with the Admin console Data Export tool. Google's help page Export all your organization's data sets these conditions:

• The super admin account must be at least 30 days old and have 2-Step Verification on
• Exports cover Gmail, Drive, Chat, Calendar, Groups, Keep, Voice and other services, plus shared drives and Vault-retained data where you hold Vault licenses
• Data lands in a Google Cloud Storage bucket after at least 48 hours, can take up to 14 days, and is deleted from a Google-provided bucket after 60 days
• Organizations with more than 1,000 users should contact Google Workspace support first

Google Vault gives a narrower, search-based export for retained content. Google's Vault page says it is included with Business and Enterprise editions, so confirm your own edition in the Admin console before you plan around it.

Do Google's terms restrict AI training on Google Workspace data?

Google's terms restrict AI training for apps that pull data through Workspace APIs. Under "Limited use of user data," the Google Workspace API User Data and Developer Policy (updated September 3, 2026) prohibits using user data to "create, train, or improve a machine learning or artificial intelligence model" beyond that user's own personalized model.

The policy binds developers using sensitive and restricted scopes, including their contractors and successors. The general Google APIs Terms of Service add, in section 5(e), that developers may not "Scrape, build databases, or otherwise create permanent copies" of API content unless the content owner or the law permits it.

The Admin console export is not an API app, and we found no AI-training clause in the Workspace terms themselves. If your plan is a super admin export delivered to a buyer, the API policy may not be the deciding factor. If a buyer or vendor offers to connect an app to your domain, it is. Ask counsel to confirm which route you are on.

Which Google Workspace plan and admin rights do you need?

Any Google Workspace edition can use the Data Export tool, but only a super admin can run it.

• Super admin role, 2-Step Verification and an active subscription for core service data
• Vault licenses to include data held for deleted users
• Assured Controls and some advanced editions follow a separate export page, and Assured Controls customers can name their own bucket
• One export at a time. Stopping an export needs Google Workspace support

Gmail and Drive exports hold names, email addresses, contacts, calendar entries and the full text of conversations with customers, candidates and suppliers. Drive often adds HR files, payroll spreadsheets and scanned identity documents.

The US position

In the US, start with California. The CCPA defines a sale as making personal information available "for monetary or other valuable consideration" (Cal. Civ. Code § 1798.140(ad)(1)), and a license fee from an AI buyer fits that wording on its face. Employee and business-contact data have been in scope since January 1, 2023, when the temporary exemptions expired.

Data counts as deidentified under § 1798.140(m) only if you take reasonable measures so it "cannot be associated" with a person, publicly commit to keep it that way and contractually bind every recipient. Our de-identification guide explains how to meet that standard, and our guide to the CCPA and state privacy laws covers the other states.

Other comprehensive state privacy laws, including those in Virginia, Colorado and Texas, define sales and exemptions in their own words, and several treat employee data differently from California. Map where the people in your export live before you rely on any one state's rules.

If the export could hold health information from a HIPAA covered entity or business associate, HHS recognizes two de-identification methods under 45 CFR 164.514(b): Expert Determination, and Safe Harbor, which removes 18 types of identifiers. Financial institutions under the Gramm-Leach-Bliley Act must explain customers' right to opt out of certain sharing with nonaffiliated third parties, according to the FTC.

Your own privacy promises still bind you. FTC staff wrote on February 13, 2024 that adopting more permissive data uses, such as AI training, through a "surreptitious, retroactive amendment" to terms or a privacy policy could be unfair or deceptive. Check the privacy notice, employee handbook and customer contracts in force when the data was collected.

Workplace messages raise a labor law point too. Daniel Goldberg of Frankfurt Kurnit Klein & Selz wrote in October 2026 that staff messages about pay and working conditions can be "protected concerted activity under Section 7 of the National Labor Relations Act," whether or not staff are unionized.

If you hold UK or EU data

UK GDPR and EU GDPR treat names, email addresses and message content about identifiable people as personal data. Licensing it for AI training is a new purpose, so you need a lawful basis under Article 6 and a compatibility assessment under Article 6(4), which the ICO covers in its guidance on compatibility and the reuse of personal information. This page is general information, so confirm your position with your own counsel.

What third-party content is in a Google Workspace export?

Much of a Gmail archive was written by people outside your company. Inbound email, Drive files owned by other domains, Google Groups with external members and Chat spaces with guests all carry other people's content, and much of it sits under NDAs or client contracts.

Filter by sender domain and file owner before you build the dataset. Buyers of workplace communications data will want to see how you did it.

How do you prepare a licensable Google Workspace export?

Preparing a Google Workspace export for a buyer starts with the extraction route and ends with a manifest. Work through these steps in order.

1. 1

   Confirm super admin access

   Check the account is at least 30 days old with 2-Step Verification on, and start the export at least 14 days before you need it.

2. 2

   Move data out of the temporary bucket

   Copy the export to storage you control within 60 days, or use your own bucket where your edition allows.

3. 3

   Keep apps off the domain

   If a buyer or vendor proposes an OAuth app, have counsel check the Workspace API User Data and Developer Policy first.

4. 4

   Remove third-party content

   Take out inbound external email, files owned by other domains and guest Chat messages unless the other party has agreed in writing, and keep privileged legal material out entirely.

5. 5

   De-identify and test

   Replace names, user IDs and email addresses across the Google Workspace export, then run a re-identification test on a random sample, as our de-identification guide describes.

6. 6

   Write the manifest

   Record record counts, date ranges, systems, exclusions and the export method in a data manifest that matches what you deliver.

7. 7

   Get counsel's sign-off

   Ask your own counsel to review the Google Workspace terms, your order form and your privacy notices together before any buyer sees a sample.

If you want a view on whether your Google Workspace data is licensable and what buyers might pay, start with a data valuation. We are a broker, not a law firm, so take independent legal advice before you sign any license.