# What data can I not license to AI? A category list

> Wondering what data you can't sell to AI? Some never belongs in a license. Frankfurt Kurnit lists exclusions. HIPAA and FERPA cover health and school records.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-data-can-i-not-sell-to-ai  
Published: 2026-08-16  
Updated: 2026-10-14

## The short answer

No single rule lists what data you can't license to AI. Daniel Goldberg, a partner at Frankfurt Kurnit, advises excluding privileged material, HR and payroll, health information, union communications and confidential client data. HIPAA bars covered entities from selling protected health information, and FERPA requires signed consent for student records.

This page reports what the sources say. It isn't legal advice.

## Which categories do lawyers say to leave out?

[Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) advises companies to consider excluding:

- privileged material
- HR and personnel files
- payroll and tax records
- health and benefits information
- union-related communications
- customer and partner confidential information
- licensed data
- data from regulated systems

It is the only law-firm checklist on this topic that I found. The same article makes a second point. De-identification addresses whether a record can be linked to a person. It says nothing about whether the content is confidential. So it doesn't rescue a category from the list.

Our pages on [HR and payroll records](/answers/can-i-sell-hr-or-payroll-records-to-ai) and [privileged email](/answers/does-selling-emails-to-ai-waive-attorney-client-privilege) cover two of them in full.

## Which rules put text behind those categories?

- **HIPAA.** [45 CFR 164.502(a)(5)(ii)](https://www.law.cornell.edu/cfr/text/45/164.502) says a covered entity or business associate may not sell protected health information. The exception is an authorization that meets 164.508(a)(4). A sale means a disclosure where the entity receives payment in exchange.
- **Regulation P.** [12 CFR 1016.10(a)(1)](https://www.law.cornell.edu/cfr/text/12/1016.10) lets a financial institution disclose nonpublic personal information to a nonaffiliated third party only after four things. It must give an initial notice and an opt-out notice. It must allow a reasonable chance to opt out. And the person must not opt out.
- **FERPA.** [34 CFR 99.30(a)](https://www.law.cornell.edu/cfr/text/34/99.30) requires signed, dated written consent before a school discloses personally identifiable information from education records, unless an exception applies.

The [health and financial data page](/answers/can-i-sell-health-or-financial-client-data-to-ai) walks through the first two.

## What about other people's data in your archive?

Email and chat hold other companies' confidential information, often under NDAs. Other data can carry competing ownership claims:

- licensed data
- open source and vendor code
- third-party copyrighted material in attachments
- data generated by vendor tools

See [your NDA](/answers/does-my-nda-let-me-sell-data-to-ai), [shared Slack channels](/answers/can-i-sell-slack-connect-or-shared-channel-messages-to-ai) and [source code](/answers/can-i-sell-source-code-to-ai).

## Do recordings and EU staff data need separate care?

Yes, each has its own page. A federal court let wiretap claims against [Otter.ai](https://uctoday.com/productivity-automation/otter-ai-fails-to-dismiss-core-privacy-claims-in-u-s-court/) go forward on 13 Aug 2026, as our [call recordings page](/answers/can-i-sell-call-recordings-to-ai) explains. [EU employee data](/answers/can-i-sell-eu-employee-data-to-ai) runs on different law.

Our [rights check](/rights-check) asks about each category and lists what to settle with counsel. Your answers stay in your browser. Talk to a privacy or commercial lawyer in your state before you sign.

Figure: comparison of Three records on the do-not-license list: HR and payroll (Leave out), Health records (emphasized: Text bars sale without consent, Sale needs authorization), Bank clients (Opt-out first). HIPAA is filled because its text bars a sale of health information without authorization.

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)
- [45 CFR 164.502(a)(5)(ii)](https://www.law.cornell.edu/cfr/text/45/164.502)
- [12 CFR 1016.10(a)(1)](https://www.law.cornell.edu/cfr/text/12/1016.10)
- [34 CFR 99.30(a)](https://www.law.cornell.edu/cfr/text/34/99.30)
- [Otter.ai](https://uctoday.com/productivity-automation/otter-ai-fails-to-dismiss-core-privacy-claims-in-u-s-court/)