# Do customer contracts allow licensing data?

> Searching whether customer contracts allow selling data? For a license, scan confidentiality, processor terms, service data, AI training and return duties.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/do-customer-contracts-allow-selling-data  
Published: 2026-09-28  
Updated: 2026-10-14

## The short answer

The contract decides. Scan five clause types: confidentiality, processor terms, service-generated data ownership, AI-training clauses and deletion duties. A processor under GDPR Article 28 works only on documented instructions. CCPA service-provider contracts must bar selling. Counsel reads the clauses.

A scan gathers facts and doesn't judge a contract. The goal is a short list of agreements and clauses to put in front of counsel, so the lawyer's time goes where it counts.

## Which clauses should you look for?

**Confidentiality and permitted use.** Find the definition of confidential information, the permitted-use clause and how long the duty lasts. Our [NDA page](/answers/does-my-nda-let-me-sell-data-to-ai) covers how a use limit meets a license.

**Processor or service-provider terms.** A data processing addendum shows whether you hold the customer's data on its behalf. Under [CCPA section 1798.140(ag)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf), a service provider's written contract must prohibit selling or sharing the personal information.

**Data generated by a service.** In the Spirit Airlines sale, the software vendor Springshot argued that data generated by its service belongs to it under its contract ([The Next Web, 18 Sep 2026](https://thenextweb.com/news/springshot-objection-spirit-airlines-data-google)). Look for the same wording in your vendor agreements.

**AI-training clauses.** [Common Paper's 2026 report](https://commonpaper.com/resources/2026-saas-contract-benchmark-report/) on 16,140 signed agreements found language prohibiting AI training in 14% of cloud service agreements, up from under 1% in 2024. Its default clause lets the vendor train on aggregated, de-identified data.

**Return and deletion.** [GDPR Article 28(3)(g)](https://gdpr-info.eu/art-28-gdpr/) has a processor delete or return personal data when the service ends. An old agreement may already require that the data be gone.

## Does the vendor-side carve-out let a customer license?

The aggregated-data clause covers the vendor's own use. My reading is that it gives a customer no right to license a vendor's or a client's records. Counsel confirms that reading against your actual wording.

## How do you sort the data first?

[Daniel Goldberg](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes), a partner at Frankfurt Kurnit, lists the inventory work as a first step: identify data held as a service provider or processor, and review platform terms for the systems the data comes from.

Sort each system into data you collected yourself, data you hold for a customer and data that belongs to a third party. The [SaaS page](/answers/can-a-saas-company-sell-its-customers-data-to-ai) covers the middle group, and the [rights check](/rights-check) asks whose records these are and what your customer contracts say.

Figure: steps List systems, pull agreements -> Mark five clauses, sort by holder -> Counsel reads clauses. A contract scan ends with marked clauses for counsel to read.

## What about buyers' own terms?

Buyers ask the owner to warrant that it holds the rights. Our [reps and warranties page](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) lists the public examples, and the [risks page](/risks) shows where deals drew objections.

Talk to a privacy or commercial lawyer in your state before you sign.

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [CCPA section 1798.140(ag)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)
- [The Next Web, 18 Sep 2026](https://thenextweb.com/news/springshot-objection-spirit-airlines-data-google)
- [Common Paper's 2026 report](https://commonpaper.com/resources/2026-saas-contract-benchmark-report/)
- [GDPR Article 28(3)(g)](https://gdpr-info.eu/art-28-gdpr/)
- [Daniel Goldberg](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)