Is it legal to sell company data for AI training?

Often, yes. We know of no US federal law that bans a company from licensing its own business records to an AI lab. What decides it is narrower: the promises you made when the records were collected, and the privacy law that protects the people named in them.

Most companies can license some of what a lab asks for, not all of it. The work is finding the line before an offer is signed. This page is general information, not legal advice. Have your own counsel review any deal.

California is the strictest test. Under the CCPA, a “sale” is any transfer of a consumer’s personal information to a third party “for monetary or other valuable consideration.” Personal information includes professional or employment-related information, so a Slack export full of employee names is in scope.¹

Deidentified data is treated differently. To qualify, the business must take reasonable measures so the data cannot be linked to a person, publicly commit not to reidentify it, and bind every recipient by contract to the same rules.¹

Getting it wrong is priced per violation: up to $2,663 for each violation and $7,988 for each intentional one, as adjusted on January 1, 2025.²

The FTC watches the promise side. It has warned that it may be unfair or deceptive to start using data for AI training and only disclose it through a retroactive change to a privacy policy or terms of service.⁶

Employees have a separate interest. Section 7 of the National Labor Relations Act protects their right to “engage in other concerted activities for the purpose of collective bargaining or other mutual aid or protection.” Channels where staff discuss pay or conditions deserve extra care, and a union contract may limit what can be shared.⁸

If your records cover people in the EU, the GDPR applies. Personal data must be “collected for specified, explicit and legitimate purposes” and not further processed in a way that is incompatible with them. Records gathered to run the business were not gathered to train models, so a lawful basis has to be shown for the new use.⁴

Truly anonymous information sits outside the GDPR. Pseudonymised data does not: if names were swapped for codes that can be reversed, it is still personal data.⁵

Fines for breaching these principles reach €20 million or 4% of worldwide annual turnover, whichever is higher.³

Regulators are testing this now. On 4 March 2026, a court in The Hague rejected Reddit’s bid to halt the Dutch data protection authority’s investigation into its sale of user content for AI training.¹¹

Owning the records is not the same as having the right to license them. Email and chat hold customers’ confidential information under NDAs. Some vendors claim the records their platforms generate. In Spirit Airlines’ bankruptcy sale, a software vendor objected that part of the data belonged to it.¹⁰

Platform terms matter too. Slack’s API terms bar third-party apps from using “API Data to train a large language model.” That is why exports run through tools your own admins control, not a lab’s connector.⁷

Pull your customer agreements and current privacy policy first. They usually decide which systems and date ranges are clear to license.

Labs pay for this kind of record because it barely exists on the public web. Reddit’s S-1 put the combined value of its data licensing contracts at $203.0 million. See what company data is worth.⁹

Through Allied, the seller grants an AI lab a license to an anonymized copy. You keep ownership and the originals. The license is non-exclusive and forbids reidentification and resale. Allied arranges the deal, with no cost to the seller.

Before any offer, we read your employee policies, customer contracts and privacy notices. Anything they do not clearly allow is left out. You choose the systems, from Slack and Teams to email, CRM, Zendesk tickets and GitHub repositories. HR, legal and board material is excluded by default. The systems labs license.

Names, contact details, account numbers and customer identities are removed before anything leaves, and you approve a sample in writing. How anonymization works.

The fit is 25 or more employees and more than a year of records. A written offer follows in one to two weeks after the discovery call, typically $100K–$2M. Payment arrives by wire 30 to 60 days after the lab accepts delivery. Standard terms.