Is it legal to sell company data for AI training? (US)

In short

No single US law bans companies from licensing their data for AI training, but privacy, sector, contract and labor rules all apply.
The privacy notice in force when data was collected is the starting point, and the FTC has warned against quietly changing terms to allow AI use.
Under California's CCPA, transferring personal information for value can be a sale, which brings notice and opt-out duties.
Health, financial, education and biometric data each carry their own federal or state rules.

This guide is general information, not legal advice. Take advice from a qualified lawyer on your specific data before you license it.

The short answer

Usually yes, for data you have the rights to, once personal information is handled properly and contracts allow it. The work is in confirming those conditions for each data set.

Privacy notices and the FTC

What you told people when you collected their data is the starting point. The Federal Trade Commission has warned that companies changing their terms quietly, or retroactively, to allow AI training could be acting unfairly or deceptively (FTC). If your notice did not cover this use, the safer routes are de-identification, fresh consent, or excluding that data.

State privacy laws

California's Consumer Privacy Act treats making personal information available to another business for value as a sale, with notice and opt-out obligations (California Attorney General). CCPA also sets specific requirements for data to count as de-identified, including technical measures, a public commitment not to re-identify, and contract terms with recipients (Frankfurt Kurnit Klein & Selz). Many other states now have comparable laws.

Sector rules

Data	Law	What it means
Health information from covered entities	HIPAA	De-identify by safe harbor or expert determination before licensing (HHS)
Customer financial information at financial institutions	GLBA	Limits on sharing nonpublic personal information
Student education records	FERPA	Consent or a specific exception is required
Voiceprints, face geometry, fingerprints	Illinois BIPA and others	Written consent for collection and limits on profiting from biometrics (Illinois General Assembly)
Children's data	COPPA	Parental consent rules for under-13s

Contracts and platform terms

Customer and partner agreements, NDAs and data processing agreements may restrict use
Licensed third-party data usually cannot be relicensed
Software platform terms can restrict training use of exported data, as Slack's API terms do (Slack)
Vendor contracts may give vendors rights in data their tools generate

Employees and labor law

Employee communications about pay or working conditions can be protected concerted activity under the National Labor Relations Act. Collective bargaining agreements may limit a sale or require bargaining (Frankfurt Kurnit Klein & Selz).

Copyright

If you license content you own, a license gives the buyer clear permission. Content created by others (customer uploads, contributor work, embedded third-party material) needs its own rights basis. The US Copyright Office has reported on generative AI training and licensing (US Copyright Office).

Transparency rules for buyers

Buyers increasingly must disclose their training data sources. California AB 2013 requires developers of generative AI systems to publish information about training data, including whether data was purchased or licensed (LegiScan), and the EU AI Act sets similar transparency duties for general-purpose models (European Commission). Expect your company may be named as a source.

A practical checklist

Inventory data and its origins
Read the privacy notice and terms in force at collection
Review customer, vendor and platform contracts
Identify sector rules
Exclude high-risk categories
De-identify with a documented protocol
Restrict resale, re-identification and purpose in the license
Record every decision

Questions

Do I need customer consent to license their data?

It depends on what your privacy notice said, the type of data, applicable state laws and whether the data is de-identified. Ask counsel to review your notice and data before deciding.

Is de-identified data exempt from privacy laws?

Often, if it meets the specific legal standard for de-identification under the relevant law. CCPA and HIPAA each define their own standard.

Do I have to register as a data broker?

Some states require data brokers that sell personal information about consumers they have no direct relationship with to register. Licensing de-identified business data is usually outside that, but check with counsel.

Is it legal to sell company data for AI training?