Is it legal to license business data to AI developers in the US?

The short answer

It can be, and whether it is depends on the records rather than the idea. A data license is a contract: the company grants an AI developer permission to use a defined set of records on agreed terms. Three layers decide whether a particular company may grant that permission for a particular dataset: who owns the records, what its contracts and privacy promises allow, and which privacy or sector laws apply to what the records contain.

Records that employees created in the ordinary course of business, about business activity, with personal details removed, are the most straightforward case. Records held for clients, consumer personal data, patient information and call recordings need more work, and some cannot be licensed at all.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Layer one: does the company own the records?

For staff work, generally yes; for contractors, not automatically. Under US copyright law, work an employee prepares within the scope of employment is a work made for hire, and the employer is treated as its author and owner, as the Copyright Office explains in Circular 30. Commissioned work from contractors counts as made for hire only if it falls into one of the categories listed in 17 U.S.C. section 101 and both parties signed a written agreement saying so; otherwise ownership turns on any written assignment.

In practice:

• Internal email, reports, SOPs, tickets and code written by employees are the easiest to establish.
• Deliverables from freelancers, contractors and agencies need their contracts checked for assignment language.
• Third-party material in your systems, such as purchased research, vendor manuals or a client's own files, is not yours to license.

Layer two: what do contracts and privacy promises allow?

Ownership is not enough if the company promised not to use material this way. Review client contracts, NDAs and data processing agreements, which often limit how client information may be used or disclosed, and check the vendor terms for the systems you would export from.

Privacy promises matter too. FTC staff wrote in January 2024 that promises not to use customer data for undisclosed purposes, such as training models, are enforceable, and in February 2024 that adopting more permissive data practices, such as using consumers' data for AI training, while telling consumers only through a quiet, retroactive change to terms of service or a privacy policy could be unfair or deceptive. Both are staff posts, not rules, but they show how a regulator reads the question.

Layer three: which privacy and sector laws apply?

That depends on whose information sits inside the records. The table covers common situations.

Other states have their own privacy and recording laws, and they differ in detail, so counsel should check each state where the company has customers or staff.

How do rights review and de-identification happen before delivery?

In a SourceX license the legal questions are settled before any data moves:

1. Qualification. SourceX asks about size, history, data breadth and rights, and confirms an authorized sponsor: the owner, CEO, CFO or another authorized representative.
2. Inventory. The company lists each system, the years it covers and what it contains, which shows where client, consumer, health or financial information sits.
3. Scope and redaction rules. De-identification and redaction requirements are agreed with the company before any work begins. Systems or fields that cannot be cleared stay out.
4. Agreement. Price and terms are agreed and signed. The company keeps ownership; the data is licensed, not sold.
5. Delivery. Data is prepared and delivered only after the executed agreement and the company's authorization.

Referral partners take no part in this. They make the introduction and never export, upload or describe confidential records. For how the commercial side of these deals compares with publisher licensing, see enterprise AI data licensing deals.

Disclosure and consent good practice

• Read the privacy policy and customer terms that applied when the data was collected before scoping anything.
• Do not rewrite policies or terms retroactively to fit a license.
• Leave out any system holding client records unless those clients consent in writing.
• Check recording notices for each state where callers and staff are located.
• Keep a written record of what was excluded and why; a future acquirer or auditor may ask.

Advisors walking a client through these steps will find more in helping clients license business data to AI labs.

Questions to ask your counsel

• Do our employment and contractor agreements give the company ownership of the work product we plan to license?
• Do any client contracts, NDAs or data processing agreements restrict this use?
• What did our privacy policy and notices promise when the data was collected?
• Do the CCPA, HIPAA, GLBA or the GDPR apply to any part of the dataset, and which de-identification standard should we use?
• Were call recordings made with the consents our states require?
• Does an exclusive AI-training license conflict with any license or commitment we already have?

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Next step

Before engaging a lawyer, check whether the company fits at all with the 10-question self-check or the company fit checker, and read how it works to see where rights review sits. Companies can apply directly at sourcex.si/apply. Advisors who want to introduce a client should register as a partner.