Can you legally sell company data for AI training?

This guide sets out the legal questions buyers and their lawyers will ask before they sign, so you can answer them first. It leads with US law and covers UK and EU rules in a separate section. It describes what the law and regulators say. It is not advice on your situation, and Sell My Data To AI is a broker, not a law firm, so take independent legal advice before you license anything.

Is it legal to sell company data for AI training?

Selling company data for AI training is legal in principle, and companies do it openly. Frankfurt Kurnit Klein and Selz, in an October 2026 briefing by partner Daniel Goldberg, says such a sale can be lawful but that most companies cannot sell everything a buyer asks for, and that the work needed to sell safely is substantial.

Nixon Peabody's October 2026 alert puts the core point plainly: possessing data does not mean you have permission to transfer it. It suggests three tests. Can the seller transfer the data? Can the buyer use it for the AI purpose? Can the buyer keep and commercialize what training produces?

Does your company own the records it holds?

Your company owns the records it created through its own staff, in most cases, but not everything on its systems. Ownership has to be checked for each source.

Under section 201 of the US Copyright Act, copyright vests first in the author, but for a work made for hire the employer is considered the author. Section 101 defines a work made for hire as a work prepared by an employee within the scope of employment, or a commissioned work in one of nine listed categories, such as a compilation or a contribution to a collective work, where both parties sign a written agreement.

Contractors are the usual gap. Code, designs and reports written by freelancers rarely fit those nine categories, so the contractor keeps the copyright unless it was assigned. Section 204(a) says a transfer of copyright ownership is not valid unless it is in writing and signed by the owner of the rights. Check every contractor agreement before you include their work.

Can you sell data you hold for clients?

You usually cannot sell data you hold for clients without their agreement. Whether you can depends on your contract and on the role you play for any personal data in it.

Under California Civil Code section 1798.140(ag), a CCPA service provider processes personal information on behalf of another business under a written contract, and that contract must prohibit it from selling the data or using it for any purpose other than the business purposes it specifies. Licensing a client's data to an AI company is a purpose the client never set.

This affects agencies, software companies, call centers, outsourcers and IT providers most. Frankfurt Kurnit Klein and Selz advises vendors to check whether their customer agreements and data processing agreements would permit a sale before taking an offer.

What do your contracts allow?

Your contracts allow only what they say, and many say nothing about AI, which is not the same as permission. Read each agreement that covers the records you plan to license.

• Client contracts, which may restrict use of deliverables, client materials or information learned during the work
• NDAs, which Frankfurt Kurnit Klein and Selz notes often cover other companies' confidential information sitting in your email and chat
• Vendor and platform terms. Frankfurt Kurnit Klein and Selz points out that Slack's API terms bar third-party apps from using API data to train large language models
• Inbound licenses for content, software and research reports you use but do not own
• Open-source licenses on code in your repositories
• Employee policies and contracts, which may describe how staff communications are used

Where a contract blocks a dataset, the usual answers are to exclude it or ask the other party for written consent. Consent requests should describe the use, the buyer type and the protections in plain terms.

Does US privacy law stop you selling the data?

US privacy law does not stop you selling data outright, but it sets strict conditions on any personal data in it. The starting point is the privacy notice in force when you collected the data.

Section 5 of the FTC Act makes unfair or deceptive acts or practices in commerce unlawful. FTC staff wrote on February 13, 2024 that it may be unfair or deceptive for a company to adopt more permissive data practices, including using data for AI training, through "a surreptitious, retroactive amendment to its terms of service or privacy policy". The post cites the FTC's 2004 case against Gateway Learning, the maker of Hooked on Phonics.

State and sector laws add their own rules. The table lists the ones that come up most often in company data sales.

Our guide to CCPA, state privacy laws and GDPR when selling data for AI covers each regime, and de-identification for AI training data explains how personal data is removed.

Professional confidentiality rules apply to regulated firms on top of contract and privacy law. Rule 1.6(a) of the ABA Model Rules of Professional Conduct says a lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent, the disclosure is impliedly authorized to carry out the representation, or another listed exception applies. States adopt their own versions, so check the rule where your firm practices.

Legal privilege is a separate risk. Frankfurt Kurnit Klein and Selz warns that a sale can waive privilege and put trade secrets at risk. Accountants, medical practices and financial firms have their own rules. Our industry pages for law firms and medical practices cover the specific restrictions.

Do you need to involve staff or unions?

You may need to involve staff or unions, and it is wise to even where the law does not require it. Workplace email and chat are written by employees, and some of it is about them.

Frankfurt Kurnit Klein and Selz notes that employee discussions about pay, scheduling and conditions may be protected under Section 7 of the National Labor Relations Act, and that unionized workplaces may face collective bargaining restrictions. The CCPA has also covered employee and job applicant data since January 1, 2023, according to the California Attorney General. In the Spirit Airlines case, The Next Web reported that unions for Spirit's flight attendants and pilots objected to the data sale.

Who can sign for a closed or closing company?

For a closed or closing company, the person who can sign is usually the board during a wind-down, or the bankruptcy trustee or debtor in possession under court supervision. Their authority and duties differ from those of a company that is still trading.

In US bankruptcy, Nixon Peabody notes that section 363(b)(1) of the Bankruptcy Code restricts sales of personally identifiable information that conflict with the debtor's privacy policy, and that compliance generally needs consistency with that policy or court approval after a consumer privacy ombudsman is appointed under section 332. In the Spirit Airlines case, the ombudsman recommended on October 5, 2026 that the court approve the sale of de-identified data to Google, according to The Next Web. Our guide to selling data from a closed company covers this in more detail.

Which legal risks matter most, and how are they fixed?

The legal risks that matter most are the ones a buyer cannot fix after delivery. The table summarizes each risk area with the question a buyer will ask and the usual fix.

Can a license expose your own confidential information?

A license can expose your own confidential information, which is a commercial risk rather than a legal bar. Frankfurt Kurnit Klein and Selz notes that a buyer could use the data to build a competing product, and that models can reproduce parts of their training data in outputs. Nixon Peabody separately lists vendor pricing, security vulnerabilities and legal strategy as confidential material that needs its own review, apart from privacy and privilege.

Treat pricing files, security reports, credentials and strategy documents as exclusions by default. The training value of these records is low, and the harm if they reappear in a model's output is high.

Will the buyer disclose that it used your data?

The buyer may have to disclose that it used licensed data. California's AB 2013 requires developers of generative AI systems offered to the public to post a summary of their training data, including whether datasets were purchased or licensed, according to Perkins Coie, and Frankfurt Kurnit Klein and Selz notes that the EU AI Act has similar requirements. A past data sale will also come up in later M&A due diligence, so keep a record of what you licensed and why.

If you hold UK or EU data

UK and EU law reach the same questions by different routes. If your company is based there, or your records include people in the UK or EU, check these points as well.

• Ownership: under section 11 of the Copyright, Designs and Patents Act 1988, an employer owns copyright in works made by an employee in the course of employment, subject to any agreement to the contrary, while contractors keep theirs unless they assign it
• Database right: regulation 13 of the Copyright and Rights in Databases Regulations 1997 says the right exists where there has been a substantial investment in obtaining, verifying or presenting a database's contents
• Processors: under Article 28(3)(a) of the UK GDPR, a processor may process personal data only on documented instructions from the controller, and Article 28(10) treats a processor that decides purposes and means itself as a controller for that processing
• Solicitors: paragraph 6.3 of the SRA Code of Conduct for Solicitors requires solicitors in England and Wales to keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents
• Staff: UK and EU employers should check employment contracts, staff privacy notices and any collective agreements

How do you check your right to sell before talking to buyers?

You check your right to sell by working through each dataset against a fixed list of questions, before any sample leaves your systems. Our eight-point vetting standard covers authority to sign, ownership and chain of title, contract restrictions, privacy notice and lawful basis, third-party content, de-identification method, sample quality and manifest accuracy.

Most issues found at this stage can be fixed by excluding records or getting a client's consent. For a rights pre-check on your records, book a free consultation.