The legal map at a glance
| Data inside your files | Rule that may apply | Practical effect |
|---|---|---|
| SOPs, playbooks, templates | Usually none beyond your own contracts | Generally the safest to license |
| Customer or employee personal info (California residents) | CCPA/CPRA | A paid transfer may be a "sale" unless properly de-identified |
| Patient health information | HIPAA | Sale barred without patient authorization; de-identify first |
| Consumer financial data | GLBA | Notice and opt-out rules for sharing with third parties |
| Client confidences (law firms) | ABA Model Rule 1.6 | Informed client consent generally needed |
| Recorded calls | State wiretap and consent laws | Reuse may raise consent questions |
| Slack data pulled via API | Slack's API terms | Terms bar using API data in LLMs |
Privacy law: the big one
Under the CCPA, a "sale" means making a consumer's personal information available to a third party for money or other value (Cal. Civ. Code §1798.140). "Consumer" covers any California resident, including employees and business contacts, since the employee and B2B exemptions expired on January 1, 2023. A paid data license that includes personal information can fit that definition.
The way out is proper de-identification. The CCPA standard requires reasonable technical measures, a public commitment not to re-identify, and contracts that bind every recipient. Details: CCPA and AI data licensing.
Employees
Internal Slack and email involve your staff. Frankfurt Kurnit notes employee discussions of pay and working conditions may be protected under Section 7 of the NLRA, and recommends excluding HR, health, privileged and union data entirely (FKKS, Oct 2026). In the Spirit Airlines data sale, more than 120 members of Congress asked for employee data to be excluded (Senate Commerce). More: employee data and AI training.
Your own promises
The FTC has warned that quietly changing your terms of service to allow AI training could be unfair or deceptive (FTC, Feb 2024), and that "there is no AI exemption from the laws on the books" (FTC, Jan 2024). Check what your privacy policy and customer contracts already promise.
Contracts and platform terms
- Customer contracts and NDAs often limit how you can use their information.
- Vendor terms: Salesforce restricted bulk export and LLM use of Slack API data (Hunton).
- Client-owned records: if you hold data for clients, it's often theirs. See client data vs. company data.
The low-risk path
- Start with process documents you created and own.
- Exclude HR, health, privileged, union and payment-card data.
- De-identify everything else to a recognized standard.
- Get counsel to review the license, especially scope, re-identification bans and deletion.
Frequently asked questions
Is it legal to sell company data to AI companies?
Generally yes for business data you own. No federal law bans it, but privacy, health, financial, legal-ethics and recording laws may apply to personal or regulated information inside the data.
Do I need employee consent to sell company Slack messages?
No single US law addresses it directly, but employee data is personal information under the CCPA for California residents, some discussions may be NLRA-protected, and counsel commonly recommend excluding HR and personal content.