Do 'no expectation of privacy' policies cover AI training use of employee data?

The honest short answer

Usually not on their own. A 'no expectation of privacy' clause in a handbook or acceptable use policy mainly supports monitoring, investigations and employer access to company systems. Few were drafted with licensing workplace records to outside AI developers in mind, so treat the clause as one input rather than as consent, and plan for de-identification and counsel review first.

Owners raise the clause in good faith. It reads broadly, employees signed it and it often says the company may access anything on its systems for any business purpose. But a clause that defeats a privacy claim about the employer reading email does not automatically answer a different question: whether the company may hand that content to a third party for a new use. Commentators have flagged exactly that secondary-use gap.

What these clauses typically do and do not settle

The last row is easy to miss. Work email is full of people who never signed the handbook.

Why regulators care about secondary use

Two FTC staff posts from 2024 show the direction of thinking, although both address consumer data rather than employees, and both are staff guidance, not rules, issued under the agency's previous leadership. In January 2024 FTC staff said that promises not to use customer data for undisclosed purposes, such as training models, are enforceable whether they appear in privacy policies, terms of service or marketing. In February 2024 staff warned that quietly changing terms of service or a privacy policy to permit AI training through a surreptitious, retroactive amendment may be unfair or deceptive.

The lesson carries over: what people were told when the records were created matters, and rewriting it afterward is risky. Employment, privacy and wiretap laws add their own rules, and the federal wiretap and stored-communications questions are explained in ECPA for employers.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

How to respond when an owner says the handbook covers it

What to do instead

1. Collect every version of the communications policy and handbook, with effective dates, and note what each said about access, monitoring and use.
2. Separate business records from personal messages and from threads dominated by outside parties.
3. Apply a default exclusion list; the list of data to exclude from AI training is a good starting point.
4. De-identify what remains, under rules the company agrees with SourceX before work begins.
5. Update the policy for the future using a clause outline such as the electronic communications policy template, and apply it only from its effective date.

If the company captures screens or keystrokes, also work through the keystroke and screen monitoring checks before scoping.

For partners hearing this objection

Do not argue the law. Acknowledge the clause, explain that the licensing process does not lean on it and suggest the owner run the company fit checker for a preliminary read. Then step back: a partner introduces the company and never handles, exports or describes its records.

Next step

When the owner is ready, register as a partner and make the introduction. Sending them how it works first shows that counsel review and de-identification come before any delivery.