Customer contract data use restrictions to check before licensing company records

The short answer

Customer contract data use restrictions usually decide what a company can license. Many B2B agreements limit a provider's use of customer information to performing the services, so anything that counts as the customer's data or confidential information is generally out of scope for an AI-training license unless the customer agrees. What remains, the company's own records of how it does its work, is often licensable after redaction. The controlling text is each contract, so the answer turns on the definitions and use clauses in the agreements the company actually signed.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

What the law adds on top of the contract

The contract is the starting point, but several public rules affect how it is read and what else counsel must check.

• Privacy promises are enforceable. FTC staff wrote in January 2024 that a company's promises not to use customer data for undisclosed purposes, such as training or updating models, are enforceable whether made in a privacy policy, terms of service, promotional materials or a marketplace listing.
• Quiet changes can be a problem. A February 2024 FTC staff post warned that adopting more permissive data practices, including AI training, and telling consumers only through a surreptitious, retroactive change to terms or a privacy policy may be unfair or deceptive. Both posts are staff guidance, not rules.
• Service provider contracts limit purpose. Under California's CCPA, Civil Code section 1798.100, a business that discloses personal information to a service provider or contractor must have a written agreement limiting its use to specified purposes. A company acting as a service provider should assume licensing is not one of those purposes unless the agreement clearly says otherwise.
• Ownership follows authorship and contract. Under 17 U.S.C. 201, copyright vests in the author, the employer owns works made for hire, and rights can be transferred in whole or in part. A company can license specific rights in material it owns while keeping others, but material its customers created remains theirs.

The clauses counsel reads, one by one

How it plays out in common situations

For contact centers, see who owns call recordings at a contact center or BPO. For a closer reading of confidentiality wording, the guide to confidentiality clause use restrictions goes clause by clause.

The three-bucket sort

Once the clauses are read, sort the company's records into three buckets before anything is priced.

1. Company-owned: internal SOPs, internal email and chat about how work is done, project plans, code the company owns and finance records of its own operations. Usually in scope, subject to redaction.
2. Customer-owned: customer data, customer confidential information, deliverables assigned to customers and recordings that belong to clients. Out of scope unless the customer consents in writing.
3. Mixed or derived: tickets that describe customer systems, CRM notes about customers and aggregated metrics. These need clause-by-clause review and are often included only after customer identities and confidential details are removed.

SourceX agrees de-identification and redaction requirements with the company before any work begins, and data is delivered only after an executed agreement and the company's authorization. The page on how company data is anonymized before AI licensing explains that step. Data that belongs to someone else, used without that party's consent, is a red flag that stops a deal.

Disclosure and consent good practice

• Build a contract register by template. Companies often sign a handful of standard forms plus some negotiated paper, so reading the templates first saves time.
• Where a customer's data would add real value, ask for written consent to a specific, described dataset rather than a general permission.
• Do not amend customer terms or a privacy policy retroactively to permit AI training without clear notice.
• Keep a record of what was excluded and why, and reflect exclusions in the data inventory before pricing.
• Tell the licensee what was excluded so expectations match the delivery.

Questions to ask your counsel

• Which of our customer templates define customer data broadly enough to cover our internal work records?
• Does any aggregated-data clause permit disclosure to third parties, and for what purposes?
• Which expired agreements still carry confidentiality obligations?
• Do any agreements or data processing addenda make us a service provider or processor for the data in question?
• What have our privacy policy and marketing materials promised about AI training?
• Which customers, if any, are worth asking for consent?

The martech audit checklist helps gather the vendor-side contracts, and the guide to vetting whether an AI data licensing offer is legitimate covers what to ask the licensing platform itself.

If you are counsel and want to refer the client

Lawyers who would receive a referral reward for introducing a client should check their own state's professional conduct rules first. The ABA's Model Rules of Professional Conduct include Rule 1.5 on fees, Rule 1.8 on specific conflicts with current clients, Rule 5.4 on professional independence and Rule 7.2 on communications about a lawyer's services. Each state adopts its own version, so the text where you are licensed controls.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. Rewards become payable only after the buyer pays and SourceX receives its fee, and no reward is guaranteed. The reward is never deducted from what the company receives.

Next step

Read the three most-used customer templates against the clause table, then sort the records into the three buckets and compare the result with the who qualifies baseline. If the company has enough of its own records to matter, register as a partner to make the introduction, or have the company apply directly at sourcex.si/apply.