# Can I license employee emails to AI?

> Searching how to sell employee emails to AI? You'd license them, and state law decides a lot. California treats email contents as sensitive data.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-i-sell-employee-emails-to-ai  
Published: 2026-08-18  
Updated: 2026-10-14

## The short answer

It depends on location. California covers employee email since 2023 and counts it as sensitive unless you're the recipient. Virginia excludes employment context. The law firm Frankfurt Kurnit lists HR files, payroll, health and benefits, and union communications as categories to exclude outright. Ask counsel.

Employee email carries four layers at once. They are privacy law, labor law, privilege and partner contracts. Here is what the primary sources say, one layer at a time.

## Does privacy law cover employee email?

In California, yes. The [state attorney general's CCPA page](https://oag.ca.gov/privacy/ccpa) says the exemptions for employment-related and business-to-business information expired on 31 Dec 2022. So employee data has been covered since 1 Jan 2023.

[The statute](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) lists "the contents of a consumer's mail, email, and text messages" as sensitive personal information. The one exception is when the business is the intended recipient.

It is unclear how that applies to a company that holds employee threads with outsiders. I found no authority on the point.

## What about states outside California?

[Virginia](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/) defines a consumer to exclude a person acting in a commercial or employment context. It also counts a sale only when money changes hands. Other states differ. I'd check each state where your employees sit.

## What do federal law and contracts add?

[Section 7 of the National Labor Relations Act](https://www.nlrb.gov/about-nlrb/rights-we-protect/the-law/interfering-with-employee-rights-section-7-8a1) protects employees' right to engage in concerted activity, which means acting together on work issues.

Section 8(a)(1) bars employers from interfering with it. [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) notes that messages about pay and working conditions can fall inside it.

The mailbox also holds privileged material. That is covered in [attorney-client privilege](/answers/does-selling-emails-to-ai-waive-attorney-client-privilege). It holds partner NDAs too. Those are covered in [NDAs](/answers/does-my-nda-let-me-sell-data-to-ai).

HR and payroll threads have their own page: [HR and payroll records](/answers/can-i-sell-hr-or-payroll-records-to-ai). For the archive as a whole, with buyers, exclusions and a sample mailbox inventory, see [licensing company emails to AI](/answers/sell-company-emails-to-ai).

## Has anyone been fined or sued for licensing employee email?

I found no lawsuit, regulator action or NLRB charge over a company licensing its own employee email archive to an AI buyer. An empty search is no clearance.

The closest event is the Spirit Airlines bankruptcy sale. The flight attendants' union filed a [limited objection](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) on 18 Aug 2026. The data set holds about 100 million emails.

It asked the court to set aside flight attendant records. It also asked for a review of employee confidentiality.

Talk to a privacy or commercial lawyer in your state before you sign. The [rights check](/rights-check) and [risks page](/risks) list the questions to bring.

Figure: comparison of How three layers treat employee email: California CCPA (Covers employees), Virginia (Employment excluded), NLRA and contracts (emphasized: Apply where privacy law stops, Beyond privacy law). Contracts and the NLRA sit outside state privacy statutes, so they matter where those statutes stop.

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [state attorney general's CCPA page](https://oag.ca.gov/privacy/ccpa)
- [The statute](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)
- [Virginia](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/)
- [Section 7 of the National Labor Relations Act](https://www.nlrb.gov/about-nlrb/rights-we-protect/the-law/interfering-with-employee-rights-section-7-8a1)
- [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)
- [limited objection](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf)