- No single US law governs selling data for AI training. Privacy, sector, contract and copyright law each apply to different parts of a deal.
- State privacy laws treat many data licenses as a sale of personal data, which triggers notice and opt-out rights.
- California AB 2013 and the EU AI Act require AI developers to describe their training data, so buyers increasingly ask sellers for provenance records.
- Court rulings so far reward lawfully acquired data and punish pirated sources, which supports licensing.
The four bodies of law in a data deal
| Area | The question it answers | Where to start |
|---|---|---|
| Privacy law | Can personal information in the data be shared, and on what notice? | State privacy laws |
| Sector law | Does HIPAA, GLBA, FERPA or BIPA apply? | De-identification |
| Contract | Do customer terms, NDAs or platform terms restrict the data? | Is selling company data legal? |
| Copyright | Who owns the content, and is training a fair use? | AI copyright lawsuits |
AI-specific transparency laws sit on top: California AB 2013 and the EU AI Act require developers to document training data.
This is not legal advice
These guides explain how the rules work so you can ask better questions. Every deal needs its own legal review. We are a broker, not a law firm, and we tell clients when they need a lawyer.