Is It Legal to Sell Company Data? What 100 Privacy Policies Say

AI data buyers now phone operating companies about their Slack, email and ticket archives. The legal risk lives in what the company has already promised in its privacy policy, contracts and employee notices. This guide explains those rules, what 100 real policies promise, and four checks to run. Treat it as general information, not legal advice.

When is selling company data legal, and when is it not?

No US federal law stops a business from selling or licensing records it owns. A sale becomes illegal when it violates a privacy promise (breaking one is something the FTC can treat as deceptive), breaches a contract, ignores a sector rule, or steps on someone else's rights.

What do company privacy policies actually promise? We read 100

A standalone data sale usually collides with language the company itself published: most privacy policies reserve the right to transfer data in a merger while pledging not to sell it.

On October 11 and 12, 2026, we pulled the privacy policies of all 100 companies on the 2025 Forbes Cloud 100, 86 of them headquartered in the US. We coded each policy against a written rubric and required a verbatim quote for every "yes". The sample tilts toward large cloud companies.

• 95% of the policies (95 of 100) give the company the right to transfer personal data in a merger, acquisition or similar deal; 55% also name bankruptcy or insolvency.
• 57% say the company does not sell personal information at all. 40% concede that some disclosures could count as a "sale" under state law, mostly advertising cookies, and 13% say both.
• 56% of the policies mention AI or machine learning. 24% say they feed data into training or improving AI models, and 18% pledge that some data stays out of training.
• 66% treat the content customers put into the product as governed by the customer's contract.

The takeaway for you: a merger clause covers the sale of the business. The CCPA exempts a transfer only when the third party "assumes control of all or part of the business" (CCPA 1798.140(ad)); licensing data does not. If your policy says you do not sell, restrict any sale to de-identified data or get consent first.

Who owns company data: the company or its employees?

Anything an employee produces on the job generally belongs to the employer as a work made for hire, unless a signed agreement states differently (17 U.S.C. 201). The personal information inside a Slack message does not become free to use, and ownership cannot override a customer contract. Selling company files without permission exposes an employee to trade secret liability under 18 U.S.C. 1832.

Does licensing data count as a "sale" under the CCPA?

Yes, provided the dataset contains personal information. The CCPA treats a sale as any transfer of personal information to a third party "for monetary or other valuable consideration", and a license meets that test (1798.140(ad)).

Deidentified data escapes the statute when the business meets three conditions: it takes reasonable measures to prevent linking, publicly commits never to re-identify, and binds each recipient by contract (1798.140(m)). Our process strips or swaps identifiers before any buyer touches a record (Ashgrove); the public commitment and recipient contracts live in your notice and license. The employee and B2B exemptions expired on January 1, 2023 (Morgan Lewis).

Can a company sell employees' Slack messages and email?

Often, after de-identification, though reading workplace messages and selling them are two separate rights. The Stored Communications Act lets a messaging service's provider access stored messages (18 U.S.C. 2701(c)(1)); the statute stays silent on licensing them.

A monitoring notice doesn't amount to consent to a sale. Messages about pay can count as protected concerted activity under Section 7 of the NLRA, and union contracts can limit how they're used.

Spirit Airlines shows how this plays out. The flight attendants' union objected, and the carrier agreed to exclude health, disability, drug and alcohol testing and collective bargaining data (Miami Herald). Rep. Steven Horsford and Sen. Elizabeth Warren led 119 members of Congress in pressing Google and Spirit to protect former employees' data (Horsford).

Do customer contracts, SaaS terms or copyright limit what you can sell?

Often, and de-identification does nothing to lift those limits. Customer NDAs and master service agreements typically confine confidential information to what performing the contract requires (Beri).

Slack's API Terms, effective October 10, 2025, bar any app distributed outside your organization from training a large language model on API data or bulk-exporting message data unless a separate agreement is in place (Slack).

Sell legal communications and you risk waiving privilege (Legal 500). Licensed content remains the owner's property: the Third Circuit ruled that copying Westlaw headnotes to train a competing tool did not qualify as fair use (Haynes Boone). GPL code triggers source-sharing duties the moment it leaves your organization (GNU).

Which data needs extra steps or cannot be sold?

Health, financial and children's data fall under their own federal regimes, and certain buyers can't touch them. HIPAA only counts health information as de-identified through Expert Determination or by stripping the Safe Harbor list of 18 identifiers (45 CFR 164.514). A financial institution has to give consumers an opt-out before it shares their nonpublic personal information with nonaffiliated third parties (FTC on GLBA). For children's data, COPPA demands verifiable parental consent (FTC).

Deals that would give countries of concern access to Americans' bulk sensitive personal data are banned or restricted under the Justice Department's bulk data rule (DOJ). Taking effect April 8, 2025, it singles out China, Cuba, Iran, North Korea, Russia and Venezuela (28 CFR 202.601). PADFAA separately forbids data brokers from handing sensitive data to foreign adversaries (FTC).

Can a company in bankruptcy sell its data?

Yes, with the court supervising the sale. If the privacy policy prohibited transferring personal information, the sale has to follow that policy or win approval after a consumer privacy ombudsman reviews it (11 U.S.C. 363, 332).

Regulators track these sales (RadioShack, 2015). The FTC chairman wrote in 2025 that any 23andMe buyer should be bound by its privacy promises (FTC) ahead of court approval of the $305 million sale (AP).

Spirit Airlines is the case still pending. Google agreed to pay $10 million for Spirit's internal business data, leaving passenger profiles out. The ombudsman recommended approval on October 5, 2026, and the hearing moved to November 6, 2026, leaving the sale unapproved (Miami Herald).

What rules apply to EU and UK data?

GDPR treats licensing personal data for AI training as a new purpose, so it needs its own lawful basis or a compatibility assessment under Article 6. Pseudonymised data still counts as personal data; anonymous information is the only thing that falls outside GDPR (Recital 26).

According to EDPB Opinion 28/2024, you can't treat legitimate interest as the default basis for AI development (CMS). The UK ICO sets the anonymity bar at identification risk that is "sufficiently remote" before data counts as anonymous (ICO).

What AI answers got wrong. Google's AI Overview for "is selling data legal" claimed on October 12, 2026 that GDPR requires "explicit, opt-in consent" to sell personal data. Article 6 lists six lawful bases; consent is one.

How do you check you can sell your data? The Ashgrove rights check

Work the four checks in sequence, and stop as soon as one answers "no" for a record type. We do this with the company's counsel before any record goes to a buyer.

Once records clear, the company data value calculator puts an estimated price on them. To find buyers, see how to sell company data to AI labs; the terms side is covered in how AI data licensing works.