Is selling company data legal?

Is selling data legal? Yes, when the data is yours to license and any personal data in it is removed or handled under privacy law. A company that licenses its own operational records to an AI lab, with personal data stripped out, is in a different position from a data broker that sells lists of people.

Four checks decide your case: who owns the records, which privacy laws cover the personal data in them, what your customer contracts allow, and what your own privacy policy promises. This page takes each in turn and explains what AI data buyers do about anonymization.

When selling data is legal: the four checks

1. Ownership. The records are yours, or you hold the right to license them. Data you hold for clients usually fails this check.
2. Privacy law. Personal data in the records is either removed to the legal standard or handled under the law that applies, such as the CCPA in California or GDPR for people in the EU.
3. Contracts. Customer contracts, NDAs and vendor terms don’t forbid the use.
4. Your own promises. Your privacy policy and customer terms allow the use you have in mind.

A deal that clears all four checks has a sound legal footing. A deal that fails one can become a breach of contract or a privacy violation.

Licensing company records differs from brokering personal data

Data brokers collect personal information about people from many sources and sell it on. The California Attorney General quotes the state’s definition of a data broker: a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.

AI data buyers want records that show how a company works: SOPs, support tickets, CRM history, project files and internal documents. Data companies license those records from operating businesses, then de-identify and package them for AI labs. The business licenses its records and keeps its data.

What counts as a sale under privacy law

Privacy laws define a sale widely. If your records still contain personal data when they leave your company, a paid license can count as a sale of that data. The table shows how three regimes treat it.

California’s revenue threshold is the statute’s $25 million, adjusted for inflation by the California Privacy Protection Agency from January 1, 2025. Administrative fines reach $2,663 per violation and $7,988 per intentional violation, and the agency adjusts both amounts every two years. Many other states have laws of their own, and each defines a sale, a consumer and its exemptions a little differently. Check your state attorney general’s website for the rules that apply to you.

As of November 2026 the United States has no single federal privacy law that covers all personal data, so state laws and sector rules do the work. Bills are pending in Congress, so the picture can change.

Removing personal data changes the analysis

Licensing records with personal data removed can fall outside these laws, if the removal meets the legal standard. California’s CCPA says personal information does not include deidentified information. It defines deidentified information as information that cannot reasonably be used to infer information about, or be linked to, a particular consumer. The business must also take reasonable measures so the data can’t be tied to a person or household, publicly commit to keep it deidentified and not to attempt to re-identify it, and bind every recipient by contract to the same terms (Civil Code § 1798.140).

GDPR draws a similar line. Anonymous information falls outside the regulation, but pseudonymized data, where a name is replaced by a code that can be traced back, is still personal data (Recital 26).

The catch is free text. Support tickets, chats and emails carry names, phone numbers, order numbers and health details in places no field list will find. If identifiable data slips through, a paid license can count as a sale of personal data without the notices the law requires.

Where the removal happens also matters. If you hand over raw records and the buyer or its partner strips personal data afterward, you first disclose personal data to another company. That disclosure needs a contract that fits the law: a written agreement under California Civil Code § 1798.100(d), or a processor contract under GDPR Article 28. Ask counsel which role the buyer plays.

Customer contracts and NDAs come first

Privacy law covers personal data. Contracts cover everything else in the records. Buyers generally exclude data you hold for your own clients: if it sits under a client contract or NDA, it usually isn’t yours to license, so leave it out unless counsel says otherwise.

Read these documents before you promise a buyer anything:

• Customer contracts and NDAs: confidentiality clauses can cover anything you learned from the customer.
• Data processing addenda: these often limit the use of customer data to delivering the service.
• Tool terms: your CRM, help desk and chat vendors may restrict how you reuse what they hold, and some data inside them comes from third parties.
• Contractor agreements: work written by contractors belongs to you only if a signed agreement gives you the rights.

Employee data and internal messages

Employee information is personal data. California’s exemptions for employee and business-contact data became inoperative on January 1, 2023, so the CCPA now covers them (Civil Code § 1798.145). Virginia’s law excludes people acting in an employment or commercial context, and GDPR covers employee data in the EU.

Internal chat and email tend to carry the most risk. They mix business talk with names, health mentions, HR matters and private messages. Decide first whether messages belong in the package at all. If they do, remove personal data and tell employees what is happening.

Health, financial and children’s data

If your company is a HIPAA covered entity or business associate, patient information is protected health information. HHS describes two ways to de-identify it: Expert Determination, where a qualified expert concludes that the risk of re-identification is very small, and Safe Harbor, which removes 18 types of identifiers. Data de-identified under either method is no longer protected health information (HHS guidance).

Banks and lenders, schools, and services aimed at children are covered by their own federal rules. Get counsel’s sign-off before any of these records go into a package.

EU and UK data

If you have EU or UK customers or staff, GDPR or its UK equivalent may apply to your records. Every use of personal data needs a lawful basis under Article 6, and consent is only one of six. Article 5 limits further processing to purposes compatible with the original one, and customer data collected to deliver a service may not fit an AI-training purpose.

Fines under Article 83 reach €20 million or 4% of worldwide annual turnover, whichever is higher. That ceiling applies to breaches of the basic processing principles and of the rules on transfers outside the EU.

The FTC and your own privacy promises

Your privacy policy and customer terms are promises. The FTC says a company cannot unilaterally renege on commitments after collecting users’ data, and that quietly rewriting a policy to allow new uses such as AI training may be unfair or deceptive (FTC, February 2024). If your policy says you never sell or share customer data, licensing records that still contain it breaks that promise. Changing the policy afterward without telling customers is the pattern the FTC warns about.

How AI data buyers handle anonymization

Buyers differ on who removes personal data and when. Some de-identify the records themselves, and some use a specialist partner to strip personal data before AI labs see them. Where the buyer does the removal, your raw records reach it first, so the contract point from earlier applies.

Four questions settle the practical position:

1. Who removes the personal data?
2. By what method, and can you check a sample first?
3. Who is liable if something is missed?
4. When does the buyer delete or return what you sent?

Our guide to preparing company data for licensing covers doing the removal yourself.

A worked example of the four checks

Example: a 120-person logistics company wants to license its dispatch procedures and customer-service tickets. The procedures are the company’s own work and contain little personal data, so they are the easiest records to license. The tickets name customers, and some customer contracts limit the use of their data to delivering the service. The company removes personal data, leaves out tickets from customers with restrictive contracts, and confirms that its privacy policy allows de-identified data to be licensed. Then it asks counsel to read the license.

When to involve a lawyer

Bring in counsel before you sign any data license. Bring them in earlier if your records include EU or UK personal data, health, financial or children’s data, customer-confidential material or bulk employee messages. Exclusivity, perpetual terms, indemnities and liability caps all deserve a lawyer’s read, because that is where the money and the risk sit. Our guide to data licensing explains the clauses.

Next steps

To see which records buyers license, read what company data you can sell to AI labs. For the whole process, from ownership check to payment, start at how to sell your company’s data to AI companies. To see whether your records could qualify, take the four-question eligibility check.