Selling company data to AI companies from the United States

This guide explains how US federal and state law applies when a US company licenses its records to an AI buyer. It builds on our general guides to whether you can legally sell company data and UK GDPR, EU GDPR and CCPA, and links to our state guides for California, New York, Texas, Illinois, Colorado, Washington and Virginia.

Is there a federal law that governs selling company data to AI companies?

There is no federal law that governs selling company data to AI companies as a whole. The US has no comprehensive federal privacy statute, so the rules depend on what is in the records, which industry you are in and where the people in the data live.

In practice, a US seller checks four layers: the Federal Trade Commission Act, federal sector laws such as HIPAA and GLBA, state comprehensive privacy laws, and specific state laws on biometrics and call recording. Copyright and contract terms sit on top of all four.

What has the FTC said about AI training and privacy promises?

The FTC has said that companies must keep the privacy promises they made when they collected data, including when the new use is AI training. Section 5 of the FTC Act, 15 U.S.C. 45, declares unfair or deceptive acts or practices in commerce unlawful, and the FTC applies it to privacy notices.

In a February 13, 2024 post, the FTC's Office of Technology said it may be unfair or deceptive for a company to adopt more permissive data practices, such as sharing data with third parties or using it for AI training, through a surreptitious, retroactive change to its terms of service or privacy policy. It cited its case against Gateway Learning, which changed its privacy policy to share consumer data without notice or consent, and a 2023 case against the genetic testing company 1Health.io.

A January 9, 2024 FTC post added that the agency has required companies to delete products, including models and algorithms, built from unlawfully obtained data. For a seller, the point is direct: the privacy notice in force when you collected each record sets the limit on what you can license, and a quiet update does not cover data you already hold.

Which federal sector laws restrict a data license?

Four federal sector laws restrict a data license most often: HIPAA for health records, GLBA for consumer financial data, FERPA for education records and COPPA for children's data collected online. Each one applies only to certain organizations and certain records.

The COPPA amendments were published in the Federal Register on April 22, 2025, took effect on June 23, 2025 and required compliance by April 22, 2026. In the rule's preamble, the FTC wrote that disclosures of a child's personal information to third parties for monetary or other consideration, for advertising or to train or otherwise develop artificial intelligence technologies are not integral to a website or online service.

Most sellers exclude health, financial account and children's data rather than try to clear it. Our industry pages for medical practices and financial services cover the detail for those sectors.

Which states have comprehensive privacy laws?

Twenty-one states have enacted comprehensive privacy laws, starting with California. Oklahoma became the 20th and Alabama the 21st in spring 2026, according to a JD Supra summary of the new laws. Florida also has a narrower law, which some trackers, including MultiState, add to their count.

The laws share a structure but differ on the point that matters most to a seller: what counts as a sale. California and Colorado cover exchanges for money or other valuable consideration. Virginia covers only exchanges for monetary consideration. Most of the laws exclude people acting in an employment context, but California does not, so staff email can be in scope there.

These laws protect residents of each state, not companies based there. A Texas company holding records about Californians has to consider California law for those records. Our guide to data privacy laws for AI training by country covers the same question outside the US.

Do state biometric laws apply to AI training data?

State biometric laws apply to AI training data whenever the records include fingerprints, voiceprints, face geometry or similar identifiers. Three states have standalone biometric statutes, and they treat a sale very differently.

• Illinois: the Biometric Information Privacy Act bars a private entity from selling, leasing, trading or otherwise profiting from biometric identifiers, and gives individuals a right to sue for $1,000 or $5,000 per violation
• Texas: Business and Commerce Code section 503.001 bars selling or disclosing biometric identifiers captured for a commercial purpose except in narrow cases, with civil penalties of up to $25,000 per violation recovered by the Attorney General. Since January 1, 2026 it does not apply to training AI models unless a system is used to uniquely identify a specific person
• Washington: RCW 19.375.020 bars selling or disclosing an enrolled biometric identifier for a commercial purpose without consent, and the chapter may be enforced solely by the Attorney General

Comprehensive laws add a second layer. Virginia, Colorado and others treat biometric data used to identify a person as sensitive data that needs consent. Treat voice and video archives as biometric risk until a lawyer has reviewed them.

State AI laws affect a data license mostly through what buyers must disclose about their training data. California's AB 2013, in force from January 1, 2026, requires generative AI developers to post whether their datasets were purchased or licensed and whether they include personal information.

Colorado repealed its 2024 AI Act in May 2026 and replaced it with SB26-189, which Lathrop GPM says requires developers from January 1, 2027 to tell deployers the categories of data used to train covered systems. Texas's House Bill 149 took effect on January 1, 2026 and added an AI training exemption to the state's biometric law. Virginia's high-risk AI bill, HB 2094, was vetoed on March 24, 2025.

None of these laws bans licensing training data. They do mean buyers will document your data more closely, so agree in the license how your company and data may be described.

Which states require all-party consent to record calls?

About 11 states require the consent of all parties to record a private conversation, according to the Reporters Committee for Freedom of the Press: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Pennsylvania and Washington. Federal law, 18 U.S.C. 2511, needs the consent of at least one party.

Some states mix the rules. The same guide says Oregon requires all-party consent for in-person conversations but one-party consent for phone calls, while Nevada and Connecticut require all-party consent for phone calls only. For a seller of call recordings, the question is whether every recording was lawfully made and whether the notice callers heard covers a later license.

Is training on licensed data a copyright issue in the US?

Training on copyrighted material is a live copyright issue in the US, which is one reason AI companies license data rather than rely on fair use. The US Copyright Office's Part 3 report on generative AI training, released in pre-publication form on May 9, 2025, concluded that some training uses will be fair and others will not.

The report says the outcome depends on what works were used, from what source, for what purpose and with what controls on outputs. It also says licensing agreements for AI training are emerging in some sectors and that government intervention would be premature. The Office says a final version will follow without substantive changes.

The courts are split. Manatt summarizes two June 2025 district court rulings in California that found training was fair use on their facts. On September 29, 2026, the Third Circuit affirmed that ROSS Intelligence's use of Westlaw headnotes was not fair use, which IPWatchdog describes as the first major circuit court ruling on fair use for AI training.

Two points follow for sellers. First, you can only license copyright you own, so check employee and contractor assignments. Second, the US has no separate database right, and the Supreme Court held in Feist v. Rural Telephone (1991) that facts are not protected, so the value you sell often rests on contract and confidentiality as much as copyright.

How are AI data license payments reported for tax?

AI data license payments to a US seller are usually reported to the IRS by the buyer, and the buyer will ask for your Form W-9 first. The IRS says Form W-9 gives a payer your correct taxpayer identification number for the information returns it must file.

The IRS instructions for Form 1099-MISC say royalties of $10 or more, including royalties for intangible property such as copyrights, go in box 2. The same instructions say payments to corporations are generally not reportable, with exceptions such as medical and attorney payments, and that the minimum for certain other information returns rose to $2,000 for tax years beginning after 2025. If you do not provide a correct number, the IRS says backup withholding applies at 24%.

Whether a payment is a royalty, a sale of property or a fee for services depends on the contract, and state sales tax rules on data and digital products vary. Take tax advice before you sign, and see our guide to tax on AI data license payments.

Which buyers accept sellers from the US?

Several buyers in our directory say they want US sellers. micro1 says demand is strongest in the US, then the UK and Canada. Endless Data prioritizes companies in the US, UK and Canada. AWS Data Exchange lists the US among the jurisdictions where paid sellers may be resident or incorporated.

What are the US rules at a glance?

What should a US seller do before talking to buyers?

A US seller should map whose data is in each dataset and which law applies to it before any sample leaves the company. Our eight-point vetting standard covers authority to sign, ownership, contracts, privacy notices, third-party content, de-identification, sample quality and manifest accuracy.

Most issues found at this stage are fixed by excluding records or de-identifying them by a documented method, as our guide to de-identification for AI training data explains. For a view of likely buyers, a realistic range and the rights issues to clear, start with a free data valuation.