Can a SaaS company license its customers' data to AI?
The short answer
Usually not, on the text of the rules. GDPR Article 28 limits a processor to documented instructions. CCPA requires a service provider's contract to prohibit selling customer data. Customers have sued vendors over AI training. Ask counsel whether your contracts make you a processor.
A software vendor stands on the other side of this question from a company licensing its own archive. The rules for the two differ.
What is a GDPR processor, and what limits a SaaS vendor?
Under the GDPR, a processor handles data for a controller. Article 28(3)(a) says the processor processes personal data "only on documented instructions from the controller."
Article 28(10) says a processor that determines the purposes and means of processing is considered a controller for that processing.
The CCPA reaches the same place by contract. Its definition of a service provider requires a written contract. The contract must prohibit the provider from selling or sharing the personal information.
Have customers sued over this?
Yes, though the cases are about vendors. None involves a company licensing its own archive.
In re Otter.AI Privacy Litigation (N.D. Cal., Judge Eumi K. Lee, order of 13 Aug 2026) let several claims go forward. They were Wiretap Act, California privacy-act and Illinois biometric claims. The target was a meeting-notes vendor accused of training its models on recorded conversations. These are allegations at the motion-to-dismiss stage.
Khan v. Figma (N.D. Cal., filed 21 Nov 2025) alleges breach of contract and trade-secret misappropriation over AI training on customer designs. Bloomberg Law reported that the court compelled arbitration.
What do SaaS contracts say about AI training?
Common Paper's 2026 benchmark looked at 16,140 signed agreements. It found 14% of cloud service agreements prohibit AI training on customer data, against under 1% in 2024. Its default clause lets the vendor train on aggregated, de-identified data.
That carve-out covers the vendor's own use. My reading is that it doesn't authorize a sale to a third party.
If you're a customer, take the vendor's terms and your own contracts to counsel before anyone licenses the data. If you're the vendor, talk to a privacy or commercial lawyer in your state before you sign.
For the company-side view, see licensing customer data.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
