Is it legal to sell or license a company's own operating records to AI labs?
Short answer. Often yes, for records the company owns and has the right to use this way, but there is no single answer. Ownership, customer contracts, privacy notices and de-identification each decide what can go. This is general information, not legal advice, and counsel reviews the specific records.
General information, not legal advice.
Whose records are they
Operating records fall into three groups, and each is treated differently. The first group is records the company made for itself: its own invoices, schedules, internal procedures and project notes. The second is records held for clients, such as a client's files, a customer's accounts or data entered by a client into the company's service. The third is material licensed in from a vendor or a data provider, such as a reference library or a purchased list.
The company can usually decide about the first group, once the privacy and contract questions below are answered. The second group belongs to the client or is held under that client's terms, so the contract decides. The third group is bound by the vendor's license, which often bars passing the material on. A record can sit in more than one group at once, so the work starts with sorting.
What contracts and privacy notices promised
Customer contracts may restrict how data about the customer is used, who may see it, and whether it can leave the company. Confidentiality clauses, data processing terms and security addenda are the places to look. A privacy notice is also a promise. If it told people their information would be used only to provide a service, using it to supply an AI lab is a different use.
The wording of the notice at the time the information was collected matters most. A notice rewritten later does not necessarily reach back to records gathered under the earlier one. Counsel reads the notice versions and the contracts together and marks which records are cleared, which need consent, and which stay out.
The FTC staff warning on quiet changes
In February 2024, staff of the Federal Trade Commission's Office of Technology and Division of Privacy and Identity Protection published a post titled 'AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive.' It said it may be unfair or deceptive for a company to loosen its data practices, for example by using data for AI training, and tell people only through a hidden, retroactive edit to its terms or privacy policy. It added that a company that collected data under one set of commitments cannot later drop them without consent.
A month earlier, FTC staff wrote in another post that there is no AI exemption from the laws on the books, and that promises in marketing, terms and similar places count. These are staff posts, not rules, and they signal where the agency is looking. They are why a company should not rewrite its policy just to clear records for a license. The safer route is to license only what the existing promises already allow, or to get clear consent for the rest.
De-identification, and what this is not
Removing names, account numbers and other identifiers reduces the privacy questions, and many operating-record sets are built that way. It does not end the contract questions: a client's confidential terms stay confidential after a name is removed. Our page on de-identification explains how identifiers are removed and sampled for review.
This is also not the sale of consumer profiles. A profile follows one person across places, and brokers in that trade sell it to marketers. An operating-record license is about how a business works: the tickets, work orders, drafts and procedures it produced. Individual people are not the subject, and the company's own records, not a list of people, are what is described.
What counsel checks
Counsel checks who owns each group of records, what each customer contract allows, which privacy notice applied when the data was collected, whether any vendor license bars onward use, and which state or sector laws touch the records. Counsel also checks trade secret status, because showing confidential material to a buyer without safeguards can weaken a claim that it was kept secret. The federal definition of a trade secret asks that the owner took steps to keep the information confidential. After that review, the owner decides what is offered, and the terms are worked out with the owner.
Follow-up questions
Do we need to tell customers before records go to an AI lab?
It depends on the contract, the notice and whether the records identify anyone. Records with identifiers removed and no client confidences may not need it, but counsel confirms that for each set.
Can we update our privacy policy first and then license?
An update helps only for information collected after people are told of it. The FTC staff warned against quiet, retroactive changes, so older records stay under the older promises unless there is clear consent.
Is a client's data ours if it sits in our system?
Usually no. Holding data for a client generally means the client's terms govern it. The contract tells you, and records of that kind are left out of the license unless the client agrees.
Which laws apply to a record set?
That depends on the sector, the people involved and the states they live in. Health, finance, children and biometric data each have their own rules, which counsel matches to the actual records.
Didn't find your question? Ask us directly.
Sources
- FTC Office of Technology and Division of Privacy and Identity Protection, AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive
- FTC Office of Technology, AI Companies: Uphold Your Privacy and Confidentiality Commitments
- 18 U.S.C. 1839, definitions for trade secrets (Cornell Legal Information Institute)