Selling company data to AI companies in California

This guide covers California law for companies licensing records to AI buyers. Federal law and other states' laws still apply, as our US guide explains. The CCPA's de-identification standard is covered in our guide to UK GDPR, EU GDPR and CCPA, so this page focuses on what is specific to California.

Does the CCPA apply to a company licensing data to AI?

The CCPA applies to a company licensing data to AI if it meets one of the statute's thresholds and does business in California. The California Privacy Protection Agency adjusted the gross revenue threshold to $26,625,000 from January 1, 2025. The other thresholds cover businesses that buy, sell or share the personal information of 100,000 or more consumers or households, or that earn half their revenue from selling or sharing it.

California differs from most states on staff data. The California Attorney General's CCPA page says the exemptions for employment-related personal information and business-to-business information expired on December 31, 2022. Workplace email, chat and CRM records about California staff and business contacts are therefore personal information under the CCPA.

Is licensing data to an AI company a sale under the CCPA?

Licensing personal information to an AI company for money or other valuable consideration is a sale under the CCPA. The Attorney General's guidance says a business that sells personal information must offer a Do Not Sell or Share My Personal Information link and must honor opt-out requests, including those sent through a global privacy control.

Data that meets the CCPA's de-identification standard in Civil Code section 1798.140(m) is outside the definition of personal information. Most sellers aim for that standard, or exclude personal information entirely, because opt-out duties are hard to meet for an archive that has already been collected.

What counts as de-identified in California?

Civil Code section 1798.140(m) treats information as de-identified only if it cannot reasonably be used to infer information about, or be linked to, a particular consumer, and the business meets three conditions.

• It takes reasonable measures to ensure the information cannot be associated with a consumer or household
• It publicly commits to keep and use the information in de-identified form and not to try to re-identify it
• It contractually obliges every recipient to comply with the same subdivision

The public commitment is the step sellers most often miss. A short statement in your privacy policy, plus matching clauses in the license, is the usual way to meet it. Our guide to de-identification for AI training data covers the technical method.

California also clarified in 2024 that personal information can exist inside AI systems. The Future of Privacy Forum notes that AB 1008 amended the CCPA's definition to cover abstract digital formats, including AI systems capable of outputting personal information. Buyers in California therefore ask hard questions about what personal data a dataset contains.

What do the CPPA's 2026 regulations require of sellers?

The CPPA's 2026 regulations require businesses to carry out risk assessments before certain processing, including selling or sharing personal information. The agency says the Office of Administrative Law approved the regulations on September 22, 2025 and that they took effect on January 1, 2026.

The National Law Review lists the risk assessment triggers as selling or sharing personal information, processing sensitive personal information, using automated decisionmaking technology for significant decisions, using personal information to train that technology and certain automated inferences. It gives compliance dates of January 1, 2027 for the automated decisionmaking rules and December 31, 2027 for risk assessments.

A risk assessment asks whether the privacy risks of a processing activity outweigh its benefits. For a data license, that means documenting what personal information is included, why, what safeguards apply and what the buyer may do with it. The same evidence answers most buyer due diligence questions.

AB 2013 means your buyer may have to say publicly that it licensed data from you. Civil Code section 3111 requires developers of generative AI systems made available to Californians to post, on or before January 1, 2026 and before each later release or substantial modification, a high-level summary of the datasets used to develop the system.

The summary must state, among other items, whether the datasets were purchased or licensed by the developer, whether they include personal information as defined in section 1798.140(v), and whether they include copyrighted material. It must also describe the sources or owners of the datasets. Goodwin reports that xAI has challenged the law in court.

Agree in the license how the buyer may describe your data in these summaries. Some sellers ask to be described by category rather than by name, which the high-level format may allow. Our page on telling staff and clients about a data license covers why disclosure planning matters.

Could licensing data make your company a data broker?

Licensing data could make your company a data broker if it knowingly sells personal information about people it has no direct relationship with. The CPPA uses that definition under the Delete Act, and registered brokers pay a fee of $6,000 for 2026.

The CPPA says registered data brokers must begin processing consumer deletion requests through its Delete Request and Opt-out Platform on August 1, 2026, and must access the platform at least once every 45 days. Archives often hold personal information about people your company never dealt with directly, such as contacts named in email threads. Ask a lawyer whether that changes your position before you license them.

Do California's call recording rules affect a license?

California's call recording rules affect a license because California requires the consent of all parties to record a confidential communication under Penal Code section 632. The Reporters Committee for Freedom of the Press lists California among about 11 all-party consent states.

Before licensing sales or support calls, confirm that every recording was made with the required consent and that the notice callers heard does not rule out later use. Our call recording data page sets out what buyers check.

Which buyers accept California sellers?

Buyers that accept US sellers accept California companies. micro1 says demand is strongest in the US, Endless Data prioritizes the US, UK and Canada, and AWS Data Exchange lists the US as an eligible seller jurisdiction. None of these pages sets California-specific terms.

What are California's rules at a glance?

The CPPA's administrative fines are up to $2,663 per violation and $7,988 per intentional violation or violation involving known minors under 16, from January 1, 2025.

What should a California seller do before licensing?

A California seller should decide which records leave personal information in and which are de-identified, then document both, before a buyer sees a sample. The steps below follow the statute and the CPPA materials cited above.

1. 1

   Check the thresholds

   Confirm whether your business meets a CCPA threshold, including the $26,625,000 revenue figure.

2. 2

   Map staff and contact data

   List the California employees, applicants and business contacts in each dataset, since their data is covered too.

3. 3

   Choose de-identify or exclude

   Apply the three conditions in section 1798.140(m) to anything you keep, and remove the rest.

4. 4

   Record a risk assessment

   If personal information remains, document the purpose, risks and safeguards of the sale.

5. 5

   Agree the AB 2013 wording

   Settle how the buyer may describe your data in its public training data summary.

For a view of which buyers fit your records, a realistic range and what to clear first, request a free data valuation.