# Can a SaaS company license its customers' data to AI?

> Wondering if a SaaS company can sell its customers' data to AI? Even a license is hard. GDPR holds a processor to the customer's instructions. Ask counsel.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-a-saas-company-sell-its-customers-data-to-ai  
Published: 2026-08-21  
Updated: 2026-10-14

## The short answer

Usually not, on the text of the rules. GDPR Article 28 limits a processor to documented instructions. CCPA requires a service provider's contract to prohibit selling customer data. Customers have sued vendors over AI training. Ask counsel whether your contracts make you a processor.

A software vendor stands on the other side of this question from a company licensing its own archive. The rules for the two differ.

## What is a GDPR processor, and what limits a SaaS vendor?

Under the GDPR, a processor handles data for a controller. [Article 28(3)(a)](https://gdpr-info.eu/art-28-gdpr/) says the processor processes personal data "only on documented instructions from the controller."

[Article 28(10)](https://gdpr-info.eu/art-28-gdpr/) says a processor that determines the purposes and means of processing is considered a controller for that processing.

The CCPA reaches the same place by contract. Its [definition of a service provider](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) requires a written contract. The contract must prohibit the provider from selling or sharing the personal information.

## Have customers sued over this?

Yes, though the cases are about vendors. None involves a company licensing its own archive.

In re Otter.AI Privacy Litigation (N.D. Cal., Judge Eumi K. Lee, [order of 13 Aug 2026](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.68.0.pdf)) let several claims go forward. They were Wiretap Act, California privacy-act and Illinois biometric claims. The target was a meeting-notes vendor accused of training its models on recorded conversations. These are allegations at the motion-to-dismiss stage.

Khan v. Figma (N.D. Cal., filed 21 Nov 2025) alleges breach of contract and trade-secret misappropriation over AI training on customer designs. [Bloomberg Law reported](https://news.bloomberglaw.com/litigation/startup-founder-must-arbitrate-ai-training-claims-against-figma) that the court compelled arbitration.

## What do SaaS contracts say about AI training?

[Common Paper's 2026 benchmark](https://commonpaper.com/resources/2026-saas-contract-benchmark-report/) looked at 16,140 signed agreements. It found 14% of cloud service agreements prohibit AI training on customer data, against under 1% in 2024. Its default clause lets the vendor train on aggregated, de-identified data.

That carve-out covers the vendor's own use. My reading is that it doesn't authorize a sale to a third party.

If you're a customer, take the vendor's terms and your own contracts to counsel before anyone licenses the data. If you're the vendor, talk to a privacy or commercial lawyer in your state before you sign.

For the company-side view, see [licensing customer data](/answers/is-it-legal-to-sell-customer-data).

Figure: steps Customer sets the purpose -> Vendor processes on instructions -> Sale makes vendor a controller. Under GDPR Article 28, a processor that sets its own purposes is treated as a controller.

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [Article 28(3)(a)](https://gdpr-info.eu/art-28-gdpr/)
- [definition of a service provider](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)
- [order of 13 Aug 2026](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.68.0.pdf)
- [Bloomberg Law reported](https://news.bloomberglaw.com/litigation/startup-founder-must-arbitrate-ai-training-claims-against-figma)
- [Common Paper's 2026 benchmark](https://commonpaper.com/resources/2026-saas-contract-benchmark-report/)