Selling data for AI training under US state privacy laws

Why privacy law matters even for business data

Company archives are full of personal information: names and emails in support tickets, voices in call recordings, employee messages in chat. If you license that data to an AI company, privacy law applies to the people in it, even if they were never your customers.

The safest deals remove personal information before transfer. Where that is not possible, the questions below decide whether the license is allowed and what you must do first.

Is a data license a "sale"?

State laws define sale differently:

Virginia's definition excludes transfers in a merger, acquisition or bankruptcy in which a third party takes over the business's assets (Code of Virginia). A paid license to an AI company is not that kind of transfer.

The IAPP tracks the full list of states with comprehensive privacy laws (IAPP).

What a sale triggers

Where a license is a sale of personal data, the laws generally require:

• A privacy notice that discloses selling, in place when the data was collected
• A way for people to opt out, honored before the sale
• Consent before selling sensitive data in several states. Texas, for example, requires small businesses to get consent before selling sensitive data (Texas Attorney General)
• A data processing or license agreement with the buyer

California also counts employee and job applicant information as personal information, so internal chat and email archives are covered (California Attorney General). Businesses that sell personal information about people they have no direct relationship with may also need to register as data brokers in California (CPPA).

Thresholds

The laws apply only above size thresholds. Colorado, for example, applies to businesses that process personal data of more than 100,000 Colorado residents a year, or that earn revenue from selling data of 25,000 or more (Colorado Attorney General). Many small companies fall below the thresholds, but their buyers will still ask how the data was collected.

De-identified data

Most state laws exclude de-identified data, but only if the business takes reasonable measures so it cannot be linked to a person, publicly commits not to re-identify it, and contractually binds recipients not to re-identify it. Virginia, for example, defines de-identified data as data that cannot reasonably be linked to an identified or identifiable person or device (Code of Virginia). Removing names alone is rarely enough. Read de-identification for AI training data.

Biometrics: the Illinois rule

Illinois's Biometric Information Privacy Act bars private entities from selling, leasing, trading or otherwise profiting from a person's biometric identifier or biometric information (Illinois General Assembly). Face geometry and voiceprints count. Video and audio with identifiable people from Illinois need particular care. See biometric data.

Sector laws

• HIPAA governs protected health information held by covered entities and their business associates. De-identify by Safe Harbor or Expert Determination before licensing (HHS).
• GLBA restricts sharing of nonpublic personal information by financial institutions.
• FERPA protects education records.

A practical sequence

1. Map what personal information each data set contains.
2. Check the privacy notice in force when it was collected.
3. Decide whether you can remove personal information entirely.
4. If not, confirm notice, opt-out and consent requirements state by state.
5. Put no-re-identification and use limits in the license.

Use our data rights checker for a first pass.