vaultfish
Check your data

Is it legal to license company data to AI?

& ClaudePublished Updated

The short answer

It depends on the data, others' rights in it and the buyer. We found no federal or state permit a company needs to license its own records. HIPAA limits health records, and a DOJ rule limits bulk data sent to countries of concern. Ask counsel which rules reach your archive.

1Who holdsrights, what itholds2What peoplewere told, whobuys3Counsel reads itA company's archive passes checks on rights, contents,notice and buyer before counsel reads the result.1Who holds rights, what itholds2What people were told,who buys3Counsel reads itA company's archive passeschecks on rights, contents,notice and buyer beforecounsel reads the result.

Almost every "can I license it" question has the same shape. The transfer is the regulated act, and the data decides which rules apply. We mapped the layers below and pointed each one to its own page.

We found no federal or state permit that a company needs to license its own records. Several rules still limit sales of particular data: health records, call recordings and data going to countries of concern.

The live test case is the Spirit Airlines bankruptcy sale, where a flight attendants' union objected in court. The sale has no approval.

In plain words

Holding data does not always mean you can license it.

Think of it like this

Think of the attic. Some boxes are yours. Others belong to a neighbor, or hold letters from other people. Sort the boxes before you license.

What does Frankfurt Kurnit say to check before a data deal?

Start with who else holds rights in the records. The law firm Frankfurt Kurnit Klein and Selz (FKKS) lists competing ownership claims first.

They come from NDAs, licensed material, open source and vendor-generated records. FKKS says holding data does not automatically give the right to license it (FKKS).

Our pages on NDAs, who owns company emails and attorney-client privilege take those one at a time.

What does privacy law add?

California's CCPA defines a sale as disclosing personal information to a third party for "monetary or other valuable consideration" (Civ. Code 1798.140(ad)).

A sale carries notice, opt-out and contract duties. The statute treats data as deidentified only if reasonable measures, a public commitment and recipient contracts are all in place.

California's attorney general said General Motors sold driving data to data brokers without consumers' knowledge or consent. GM settled for $12.75 million on 8 May 2026, and a settlement is not a court finding (California AG).

Our CCPA sale page and customer data page go deeper.

What about employees?

California's attorney general says the employment and business-to-business exemptions expired. So employee data has been covered since 1 Jan 2023 (CCPA FAQ). Other states vary. Federal labor law and union contracts apply either way.

See licensing employee emails for what your staff may object to.

Which data do lawyers say to leave out?

FKKS recommends excluding these:

  • privileged material
  • HR and personnel files
  • payroll and tax records
  • health and benefits information
  • union-related communications
  • customer and partner confidential information
  • licensed data and regulated-system data

FKKS also says not to rely on de-identification for them. The pages on HR and payroll records, call recordings and health or financial data cover the highest-risk categories.

Has anyone been stopped from licensing company data?

We found no lawsuit, regulator action or NLRB charge against a company for licensing its own email or chat archive to an AI buyer. An empty search is not clearance. Don't read it as one.

The Spirit Airlines sale is the closest event. The flight attendants' union filed a limited objection on 18 Aug 2026. It asked the court to exclude all flight attendant information, or add protections (Doc 1489). Our union objection page reads the filing.

Does the buyer matter?

Yes. A Department of Justice data security rule turns on who owns the buyer, so an owner needs to know. Our page on the DOJ bulk data rule reads the text.

What is the next step?

Run the rights check and read the risk map before a buyer call. The licensing guide covers the whole process. A managed readiness review collects the facts for your lawyer.

Have a lawyer read any contract before you sign. They like that.

Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral

Sources 5

The outside sources linked on this page.

  1. technologylaw.fkks.comFKKS
  2. cppa.ca.govCiv. Code 1798.140(ad)
  3. oag.ca.govCalifornia AG
  4. oag.ca.govCCPA FAQ
  5. storage.courtlistener.comDoc 1489