The Spirit Airlines warning sign
Spirit's bankruptcy data sale listed about 100M emails, 500M Teams items and 175,658 employee records (Stretto). Six objections were filed, including from flight-attendant and pilot unions, who argued that keeping links between records intact allows people to be re-identified. In October 2026, 120+ members of Congress asked for employee data to be excluded (Senate Commerce). Whatever the court decides, expect scrutiny of employee data.
Laws that may apply
- CCPA: California employees are "consumers" with full rights since 2023 (§1798.140).
- NLRA Section 7: discussions about pay and working conditions may be protected activity (FKKS).
- State monitoring laws: New York, for example, requires notice of electronic monitoring.
- Platform terms: Slack's API terms bar using API-accessed data in LLMs (Hunton).
What to exclude
| Exclude | Why |
|---|---|
| HR channels, performance reviews, discipline | Sensitive and identifying |
| Payroll, compensation, benefits | Sensitive and identifying |
| Medical and accommodation records | Health information |
| Union or organizing discussions | Possible NLRA protection |
| Legal and privileged threads | Privilege waiver risk |
| DMs and private channels | Higher expectation of privacy |
What's usually lower risk
Public project channels, engineering discussions, support escalations and ops coordination, after names and contact details are removed. These show how work gets done, which is what buyers want. See selling Slack data.
One thing you can't undo
Once data trains a model, it can't practically be "unlearned" (FKKS). Deletion clauses cover the dataset, not the model. Decide exclusions before you share.
Frequently asked questions
Can a company sell employee Slack messages to AI?
Companies have done so, mostly in shutdowns. But employee data is personal information under laws like the CCPA, some discussions may be NLRA-protected, and counsel commonly advise excluding HR, health, privileged and union content.
Can an AI model forget data after training?
Not practically. Deletion clauses cover the dataset, not the trained model, so decide what to exclude before sharing.