Do employees have to consent before their Slack messages train AI?

In the US, usually not. We know of no federal statute that requires an employer to collect each worker’s consent before licensing work messages the company controls. Ifeoma Ajunwa, an Emory University law professor, argues that “Employers should have express consent before selling workers’ data,” and she also notes there is no federal law banning such sales.²¹

In the EU and UK the logic runs the other way. Regulators doubt that staff can freely refuse their employer, so consent is a weak basis there. Notice and a right to object carry the weight there, backed by removing names.

In practice the work is the same everywhere: a written notice before the export, and names stripped before anything leaves. This page covers the employee question only. Customer contracts, platform terms and the wider legal picture are in is it legal to sell company data. General information, not legal advice.

Every Slack user accepts Slack’s User Terms. They call messages and files “Customer Data”, and each user agrees “that the Customer Data is owned by Customer”. The Customer is the organization that runs the workspace, not the employee.¹

The same terms hand the people question to the employer. It is “solely Customer’s responsibility” to tell users about its policies and to obtain “any rights, permissions or consents” needed for lawful use of that data. Slack does not ask employees on your behalf.¹

Ownership does not mean every message is equally easy to use. On Slack’s Business+ plan, owners and admins can export public channels. Private channels and direct messages need a separate tool that workspace owners must apply for, and Slack describes it as being “For legal and regulatory compliance”.²

Most handbooks add an acceptable-use or electronic-monitoring policy. Typically it says company systems are company property and messages may be reviewed. That covers the company reading its own records. It rarely mentions licensing them to an outside AI lab for training. That gap is what a new notice fills.

The 2024 uproar was about Slack training its own models on customer workspaces. Slack’s privacy principles now say Slack “will not use Customer Data to train generative AI models unless Customer provides affirmative opt-in consent.”³

Slack still trains global, non-generative models, for channel and emoji suggestions and search results. To opt a workspace out, its Org or Workspace Owners or Primary Owner email feedback@slack.com with the subject line “Slack Global model opt-out request.”³

Microsoft makes a similar promise for Microsoft 365 Copilot. It says prompts, responses and data accessed through Microsoft Graph “aren’t used to train foundation LLMs”.⁴

Notice who decides in each case: the organization, not each employee. And none of it governs your own license. These settings cover what the vendor does with your workspace. When your company licenses its own export to a lab, your company is the one disclosing, and the employee question is yours to answer.

Federal wiretap law turns on one party’s consent, not everyone’s. The Wiretap Act allows interception where “one of the parties to the communication has given prior consent”.⁵ The stored-communications part exempts conduct authorized by the service provider, or by a user for messages sent to them.⁶ Neither part addresses a company licensing records it already holds.

Three states require notice before electronic monitoring. They are notice laws, not consent laws. None of them mentions a later use such as AI training, but they show what employees were told.

If you have staff in these states, find the signed notices. They help show employees knew their messages were company records. They say nothing about AI licensing, so they do not replace a new notice.

California’s privacy law used to exempt most employee data. The California Privacy Protection Agency says the exemptions for employment-related personal information “expired on December 31, 2022.” Since January 1, 2023, a California employee has the same rights as any other consumer.¹⁰

Two rules matter here. A business may not use personal information “for additional purposes that are incompatible with the disclosed purpose” without giving new notice. And a consumer may “at any time” tell a business that sells their personal information to stop.¹¹

So California asks for notice and an opt-out, not opt-in consent. The statute also says personal information “does not include consumer information that is deidentified”.¹¹ That is why anonymization does most of the work. The deidentification test is explained in is it legal to sell company data.

Other state privacy laws can leave employees out entirely. Connecticut’s says a “consumer” does not include “an individual acting in a commercial or employment context”.¹²

Two federal points apply anywhere: the FTC’s warning about quietly rewriting privacy promises, and labor-law protection for channels where staff discuss pay or working conditions. Both are in is it legal to sell company data.

European regulators doubt that an employee can say no to an employer. The European Data Protection Board calls it “problematic for employers to process personal data of current or future employees on the basis of consent as it is unlikely to be freely given.”¹³

It is not ruled out. The EDPB accepts employee consent only “in exceptional circumstances, when it will have no adverse consequences at all whether or not they give consent.”¹³

The UK regulator takes the same line. The ICO names “an employer processing employee data” as a case where consent is not usually appropriate, because people who fear adverse consequences “might feel they have no choice but to agree”.¹⁴

Consent also has a practical cost. People may withdraw it “at any time”, and “It shall be as easy to withdraw as to give consent.” A dataset built on consent must be able to drop people after delivery.¹⁵

The usual route is legitimate interests under Article 6(1)(f). Because AI training is a new purpose, Article 6(4) asks whether it is compatible with the original one. The test looks at the link between the purposes, the employment relationship, the nature of the data, the consequences for staff, and safeguards “which may include encryption or pseudonymisation”.¹⁶

Before the new use starts, staff must be told about “that other purpose”.¹⁷ Where you rely on legitimate interests, they also have a right to object.¹⁸

The EDPB’s December 2024 opinion on AI models applies this to training. A mention of AI development in a privacy policy does not mean people “can reasonably expect it to happen”. Among the safeguards it lists are a gap between collecting a training set and using it, and “an unconditional ‘opt-out’ from the outset”.¹⁹

EU member states may add their own rules for employee data, by law or by collective agreement. Check national law and any works council agreement before the export.²⁰

This is the order that keeps the employee side clean. It works for US-only companies and for those with staff in Europe.

Labs pay for workplace conversation because little of it is public. In August 2026, in Spirit Airlines’ bankruptcy, Google outbid Mercor for the carrier’s data, including 500 million Teams messages and 176,000 employee records, for $10 million. Spirit’s flight attendants’ union objected on privacy grounds.²¹

Reddit’s IPO filing shows the market from the platform side: data licensing arrangements with an aggregate contract value of $203.0 million.²²

Your company grants an AI lab a non-exclusive license to an anonymized copy of its records, and Allied arranges the deal. Before any offer, Allied reviews your employee policies, monitoring notices and customer contracts. Records they do not clearly allow are left out.

Direct messages are excluded unless you opt in. HR, legal and board channels are excluded by default. Names and identifiers are removed in your own systems, and you approve a sample in writing before delivery. Allied never sees the data. See data handling, Slack and Teams records and email archives.

The fit is 30 or more office employees. A written offer follows one to two weeks after the discovery call. Payment arrives 30 to 60 days after the lab accepts delivery. Request an offer, see the systems labs license, or read how Allied works.