# Is it legal to license company data to AI? > Googling whether it's legal to sell company data to AI? We found no general rule on licensing it. Contracts, privacy law, staff rules and the buyer set limits. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/is-it-legal-to-sell-company-data-to-ai Published: 2026-08-21 Updated: 2026-10-14 ## The short answer It depends on the data, others' rights in it and the buyer. We found no federal or state permit a company needs to license its own records. HIPAA limits health records, and a DOJ rule limits bulk data sent to countries of concern. Ask counsel which rules reach your archive. Almost every "can I license it" question has the same shape. The transfer is the regulated act, and the data decides which rules apply. We mapped the layers below and pointed each one to its own page. We found no federal or state permit that a company needs to license its own records. Several rules still limit sales of particular data: [health records](/answers/can-i-sell-health-or-financial-client-data-to-ai), [call recordings](/answers/can-i-sell-call-recordings-to-ai) and data going to countries of concern. The live test case is the Spirit Airlines bankruptcy sale, where a flight attendants' union objected in court. The sale has no approval. > **Holding data does not always mean you can license it.** Think of the attic. Some boxes are yours. Others belong to a neighbor, or hold letters from other people. Sort the boxes before you license. ## What does Frankfurt Kurnit say to check before a data deal? Start with who else holds rights in the records. The law firm Frankfurt Kurnit Klein and Selz (FKKS) lists competing ownership claims first. They come from NDAs, licensed material, open source and vendor-generated records. FKKS says holding data does not automatically give the right to license it ([FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). Our pages on [NDAs](/answers/does-my-nda-let-me-sell-data-to-ai), [who owns company emails](/answers/who-owns-company-emails) and [attorney-client privilege](/answers/does-selling-emails-to-ai-waive-attorney-client-privilege) take those one at a time. ## What does privacy law add? California's CCPA defines a sale as disclosing personal information to a third party for "monetary or other valuable consideration" ([Civ. Code 1798.140(ad)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)). A sale carries notice, opt-out and contract duties. The statute treats data as deidentified only if reasonable measures, a public commitment and recipient contracts are all in place. California's attorney general said General Motors sold driving data to data brokers without consumers' knowledge or consent. GM settled for $12.75 million on 8 May 2026, and a settlement is not a court finding ([California AG](https://oag.ca.gov/news/press-releases/when-it-comes-data-privacy-consumers-must-be-driver%E2%80%99s-seat-attorney-general)). Our [CCPA sale page](/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa) and [customer data page](/answers/is-it-legal-to-sell-customer-data) go deeper. ## What about employees? California's attorney general says the employment and business-to-business exemptions expired. So employee data has been covered since 1 Jan 2023 ([CCPA FAQ](https://oag.ca.gov/privacy/ccpa)). Other states vary. Federal labor law and union contracts apply either way. See [licensing employee emails](/answers/can-i-sell-employee-emails-to-ai) for what your staff may object to. ## Which data do lawyers say to leave out? FKKS recommends excluding these: - privileged material - HR and personnel files - payroll and tax records - health and benefits information - union-related communications - customer and partner confidential information - licensed data and regulated-system data FKKS also says not to rely on de-identification for them. The pages on [HR and payroll records](/answers/can-i-sell-hr-or-payroll-records-to-ai), [call recordings](/answers/can-i-sell-call-recordings-to-ai) and [health or financial data](/answers/can-i-sell-health-or-financial-client-data-to-ai) cover the highest-risk categories. _Lawyers love a labeled box. Start labeling._ ## Has anyone been stopped from licensing company data? We found no lawsuit, regulator action or NLRB charge against a company for licensing its own email or chat archive to an AI buyer. An empty search is not clearance. Don't read it as one. The Spirit Airlines sale is the closest event. The flight attendants' union filed a limited objection on 18 Aug 2026. It asked the court to exclude all flight attendant information, or add protections ([Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf)). Our [union objection page](/answers/spirit-airlines-data-union-objection) reads the filing. ## Does the buyer matter? Yes. A Department of Justice data security rule turns on who owns the buyer, so an owner needs to know. Our page on [the DOJ bulk data rule](/answers/does-the-doj-bulk-data-rule-apply-to-selling-company-data) reads the text. Figure: steps Who holds rights, what it holds -> What people were told, who buys -> Counsel reads it. A company's archive passes checks on rights, contents, notice and buyer before counsel reads the result. ## What is the next step? Run the [rights check](/rights-check) and read the [risk map](/risks) before a buyer call. The [licensing guide](/guides/how-to-sell-company-data-to-ai-companies) covers the whole process. A [managed readiness review](/managed-readiness) collects the facts for your lawyer. Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [Civ. Code 1798.140(ad)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [California AG](https://oag.ca.gov/news/press-releases/when-it-comes-data-privacy-consumers-must-be-driver%E2%80%99s-seat-attorney-general) - [CCPA FAQ](https://oag.ca.gov/privacy/ccpa) - [Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf)