Can a company sell employees' emails and Slack messages for AI training?

When a company licenses its workplace data to an AI lab, the most valuable part – real emails, Slack threads and Teams chats – is written by employees. That makes the question unavoidable: can a company sell what its people wrote at work? In 2026 the question went mainstream when Spirit Airlines' archive was put up for sale in bankruptcy. This guide covers what US law says, where the real risks are and how to prepare a dataset that holds up.

This guide describes how things generally work today. It is not legal advice. Every company and every deal is different – rules vary by state and by contract, and what applies is assessed case by case. And that's what we're here for – we do the groundwork with you, involve the right experts when needed and put good deals on the table.

Why the question is everywhere right now

In August 2026, Google won a bankruptcy auction for Spirit Airlines' internal business data with a $10 million bid. According to court filings, the archive includes about 100 million emails and 500 million Microsoft Teams messages and collaboration records. Passenger profiles and loyalty data were excluded, and the data is to be scrubbed by a third party before delivery.

The reaction was strong. Spirit's flight attendants' union objected, and on October 8, 2026, more than 120 members of Congress, led by Rep. Steven Horsford and Sen. Elizabeth Warren, wrote to Google and Spirit asking them to pause the transfer of employee-related data. MIT Technology Review reported the same pattern among shut-down startups, where founders sell Slack, email and code archives to AI labs.

The takeaway for any seller: buyers want employee communication, and regulators, unions and the press are watching how it is handled.

Who owns workplace messages?

In the US, messages sent on company email and chat systems are generally treated as company records. Most employee handbooks and acceptable-use policies say exactly that, and employees usually have a limited expectation of privacy on employer systems.

But ownership of the archive is not the same as a free hand over the personal data inside it. An email thread is a company record, and it also contains names, opinions, health mentions, family matters and salary discussions about identifiable people. Those details are what privacy law protects.

What US law actually says

MIT Technology Review quoted employment law professor Ifeoma Ajunwa saying that no federal law prohibits a company from selling its employees' messages – and that she believes employers should get express consent anyway. Several other layers can still apply:

• The CCPA in California. Since January 1, 2023, the CCPA's employee data exemption has expired. Employees, job applicants and contractors have the same rights as other consumers, including notice about how their data is used and shared, and the right to opt out of its sale.
• Other state privacy laws. Several states have comprehensive privacy laws. Many exclude employee data, but not all in the same way – so the states where your staff live matter.
• Your own promises. What your privacy notice, handbook or employment contracts say about how workplace data is used matters. A promise made earlier can still apply now.
• Collective bargaining agreements. If your workforce is unionized, a sale may be a subject for bargaining, and unions have shown they will object.
• Sector rules. Health information (HIPAA), financial data and records about minors carry their own restrictions. Health data can be licensed too, but it takes extra care and is typically only licensed in de-identified form.
• Staff outside the US. If any of your employees are in the UK or EU, their data can also be covered by UK GDPR or the EU GDPR, which are stricter about reusing data for a new purpose such as AI training.

What to exclude before anything is licensed

Most of the risk sits in a small part of the archive. A good dataset is built by selection first and cleaning second:

• Direct messages and private channels. These hold the most personal content and are the hardest to defend. Most buyers value shared project channels and team mailboxes more anyway.
• HR, payroll and benefits. Performance reviews, salaries, medical leave and disciplinary cases are usually removed entirely. Suppliers in the MIT Technology Review report exclude HR records as standard.
• Legal and privileged material. Communication with attorneys is usually left out.
• Health and other sensitive details. Mentions of illness, family situations or similar are usually redacted, even in otherwise ordinary threads.
• Personal mailboxes. Some employees use work email for private matters. Those mailboxes or folders are better left out.

After selection comes de-identification: names, email addresses, phone numbers and other identifiers are replaced, and the result is spot-checked. Removing names alone is rarely enough – the Congress letter on Spirit made exactly that point. More in our guide on anonymized vs de-identified data.

The reputational side

Even where a sale is legal, it can damage trust with current and former employees, and with customers. The Spirit case shows how quickly a data sale becomes a public story. Companies that handle it well usually:

• tell employees before a decision is made, not after,
• explain what is included, what is excluded and how it is de-identified,
• choose a limited, non-exclusive license over an outright sale,
• keep documentation that shows what was done and why.

Checklist before licensing employee communication

1. Which systems hold the data: email, Slack, Teams, ticketing, documents?
2. Which states and countries do your employees live in?
3. What do your handbook, privacy notice and contracts say about workplace data?
4. Is the workforce unionized, or covered by a collective agreement?
5. Which channels and mailboxes can be excluded from the start?
6. How will HR, legal, health and personal content be removed?
7. Who signs off: management, board, counsel?
8. How and when will employees be informed?

How we work with employee data

You describe your data in a short form without sending any files, and we get back to you within 48 hours on business days. We assess rights and personal data before any buyer is involved, and nothing is shared until there is a non-disclosure agreement and an accepted offer. Delivery only happens after selection and de-identification. By default the license is non-exclusive and limited in scope, time and use, and you keep ownership. Read more about selling Slack and Teams data and email archives.

Summary

A company generally controls its email and chat archives, and according to experts no federal law specifically bans licensing them. But the personal data inside can be covered by state privacy laws such as the CCPA, by your own promises, by union agreements and – for UK and EU staff – by GDPR. The Spirit Airlines sale shows the scrutiny such deals now get. Datasets that work usually leave out DMs, HR and sensitive content, are de-identified with care, come with early word to employees and use a limited license. That is what usually makes a dataset both licensable and defensible.