Data privacy and AI training – can you license customer data?

General information, not legal advice. This page describes how things generally work today. Every dataset and every deal is different – the rules vary by state and country, and what applies is assessed case by case. That's where we come in – we guide you through it, bring in the right experts when a question calls for it, and work to find a deal that fits your data.

Privacy law and AI training in brief

When data contains personal information, privacy law generally applies – even if the data is only used to train an AI model. That covers emails, chats, support tickets, CRM history and recorded calls. Most of a company's operational data contains personal information in some form.

In the US there is no single federal privacy law. Three questions usually decide whether AI training is possible:

1. What did you promise when the data was collected – in your privacy policy, terms and customer contracts?
2. Which laws apply to the people in the data – state privacy laws such as the CCPA, and sector laws such as HIPAA, GLBA or COPPA?
3. Can the data be de-identified well enough before it leaves you?

Your privacy-policy promises come first

The FTC enforces privacy promises as part of its ban on unfair and deceptive practices. If your privacy policy said customer data is used to provide the service, licensing it for AI training is likely to be seen as a new use those customers were never told about. The FTC has warned specifically that changing privacy terms after the fact to allow AI training can itself be unfair or deceptive.

So the first document we read is not the dataset. It is the privacy policy that was in force when the data was collected.

The CCPA and other state privacy laws

California's CCPA, as amended by the CPRA, is the most cited US state privacy law, and roughly 20 states now have comprehensive privacy laws. The points that matter most for a data license:

• A license can be a "sale". The CCPA defines "sale" broadly, including making personal information available to another business for money or other valuable consideration. Where a license counts as a sale, notice and a right to opt out generally follow.
• Purpose and retention limits. The CCPA expects personal information to be used in ways reasonably necessary and proportionate to the purposes it was collected for, and kept no longer than needed.
• Sensitive personal information – Social Security numbers, financial account details, precise location, health information and more – carries extra restrictions.
• B2B and employee data are covered. Since 2023 the CCPA's exemptions for business contacts and employees have expired, so "our customers are businesses" usually doesn't take data outside the law.
• De-identified data is outside the CCPA – as the law defines it, that includes reasonable measures against re-identification, a public commitment not to re-identify, and a contract binding the recipient to the same. We go through the details in anonymized vs de-identified data.

Sector laws: health, financial and children's data

Some data comes with its own federal rules:

• HIPAA covers health information held by healthcare providers, health plans and their business associates. For a use like licensing, it is typically shared only in de-identified form, under HIPAA's Safe Harbor or Expert Determination methods. Some states, such as Washington, also protect consumer health data outside HIPAA.
• GLBA covers nonpublic personal information held by financial institutions.
• COPPA covers data about children under 13.

Health data, financial data and data about children are assessed with extra care, and are typically only licensed in de-identified form.

Can you sell customer data?

The question comes up often, and the honest answer is: it depends. Customer data isn't automatically licensable just because it is in your systems. Customers provided their details for a specific purpose – to get an item delivered, a case resolved or an invoice sent.

In many cases the way forward is to de-identify the data before it becomes relevant for a license. In other cases the data is better left out of a license altogether. We go deeper in the guide can you sell customer data?

Employees' emails and chats

Company email and Slack or Teams workspaces usually belong to the employer, but they are full of employees' personal information – and of customers' and partners' too. What usually matters is what your workplace policies told employees, whether you have a union contract that covers it, and the privacy laws above. Outside the US, rules can be stricter: in many EU countries, employee representatives or a works council are typically consulted first.

For Slack there is one more factor: Salesforce, which owns Slack, restricted bulk export and LLM training by third-party apps in its API terms update of May 29, 2025. How archives can be exported therefore also depends on the platform terms. See Slack's API terms and AI training.

Outside the US

If the data includes people in other countries, their laws can apply too:

• United Kingdom – UK GDPR and the Data Protection Act 2018, overseen by the ICO. AI training generally needs a lawful basis, often legitimate interest backed by a documented balancing test.
• Ireland and the EU – the EU GDPR. The European Data Protection Board has said in Opinion 28/2024 that legitimate interest is not automatic for AI training.
• Canada – PIPEDA and provincial laws such as Quebec's Law 25, built on meaningful consent.
• Australia – the Privacy Act 1988 and the Australian Privacy Principles.
• New Zealand – the Privacy Act 2020 and its information privacy principles.

Under the GDPR-style laws, truly anonymized data falls outside the law, but pseudonymized data – with names swapped for codes – is generally still personal data.

Copyright and documentation

Privacy is not the only question. Content can also be protected by copyright, and US courts are still working out when AI training is fair use. That uncertainty is a large part of why AI companies pay for licensed data with documented rights. Buyers also face transparency rules: California's AB 2013 requires developers of generative AI to post training-data documentation on their website, including a high-level summary of the datasets, and the EU AI Act requires similar summaries from general-purpose model providers. More on this in data licensing.

How we work

We always start with rights and personal data, not with the price.

• We prioritize data without personal information, such as published content and media archives.
• We carry out a privacy and de-identification assessment before a license is on the table.
• Nothing is shared until a non-disclosure agreement and an accepted offer are in place.
• Delivery only takes place after de-identification.
• Our documentation records where the data comes from and on what terms, which buyers can draw on for their transparency requirements.

If we see that a dataset cannot be licensed in a defensible way, we say so early. That can apply, for example, to parts of customer service data with a lot of free text. How the license itself is structured is described on our page about data licensing.