'Legally Radioactive': The Risk Checklist Before You Sell Company Data

Where "legally radioactive" comes from#

In its October 13, 2026 report on AI labs buying data from failed startups, MIT Technology Review quoted Greg Ewing, an attorney who advises AI startups, calling this kind of data "legally radioactive." He pointed to the sensitive details inside emails and calendars, such as medical appointments and school pickup plans.¹

The warning is easy to understand with an example. A company's Slack history is not a table of products. It is thousands of people talking, some about work and some about their lives. Sell it, and you are handing the buyer a record of those people.

This page is a checklist for anyone thinking about it. It draws on the Spirit Airlines sale, where the objections came in public, and on the law as stated in primary sources. It is not legal advice, and the rules differ by place and industry. We are a broker and we have an interest in this market, so we have tried to cite everything and mark what we could not verify.

What the Spirit fight showed#

Google won an August 2026 auction for Spirit Airlines' de-identified internal data with a $10 million bid. As of October 22, 2026 the sale is not approved, and the hearing has been moved to November 6, according to IBTimes UK.² The full account is on our Spirit Airlines page. The objections map onto the risks below.

• Unions. The Association of Flight Attendants-CWA argued that even de-identified data could expose flight attendants through patterns or small-group identifiers, and that anonymization does not guarantee privacy.³
• Lawmakers. On October 8, a letter signed by 121 members of Congress by IBTimes UK's count asked Google and Spirit to exclude employee records, timecards, payroll and Microsoft 365 content about flight attendants, protect any remaining medical, disciplinary or pay records, and order an independent review of staff confidentiality before any transfer. They cited the National Institute of Standards and Technology's view that data stripped of names can sometimes still reveal identities.²
• The ombudsman. The court-appointed consumer privacy ombudsman recommended approval on October 5 for the de-identified data, but her review did not assess risks to employees or third parties.⁴
• The process. The Next Web, reading the sale agreement, said the buyer can designate and pay the de-identification agent and asked who audits it. It also noted the agreement requires the data to keep "referential integrity," which the author argues makes re-identification more feasible.⁵

Google says it is not looking to buy any personal information from Spirit.⁴ The case is not decided. We use it because it surfaced the arguments in public.

The checklist#

1. Do you have the right to sell it?#

Owning data is not the same as being allowed to sell it. One analysis of micro1's program, by Pebblous, lists confidentiality clauses in customer agreements and NDAs, GDPR purpose limitation, the expired CCPA business-to-business exemption, and no-redistribution terms in vendor licenses as limits on resale.⁶ micro1's own page says companies must have the "internal approval processes and permissions" to participate, and Pebblous reads that as putting the burden of checking on the seller.⁶⁷

Check:

• Customer contracts and NDAs: do they forbid sharing content or derivatives with third parties?
• Vendor and tool licenses: Slack, Salesforce, Zendesk and others may limit how exported data can be used.
• Third-party content in your data: customers' emails, partners' documents, licensed material.
• Acquisition or investment terms. AI Weekly's example is a startup being acquired by HubSpot that was approached by Mercor about its code and task records eight days later, with the open question of whether the acquirer's deal terms would allow it.⁸

2. What did you promise customers and staff?#

The Federal Trade Commission's Office of Technology wrote in January 2024 that companies that break privacy commitments to users or customers may face liability under laws the FTC enforces, that commitments in terms of service, privacy policies and promotional materials all count, and that "there is no AI exemption from the laws on the books." It also said the FTC has in past cases required companies that unlawfully obtained data to delete products, including models and algorithms, built from it.⁹

In February 2024 the FTC added that it may be unfair or deceptive to adopt more permissive data practices, such as sharing consumer data with third parties or using it for AI training, and tell people only through a secret, retroactive change to terms or a privacy policy.¹⁰

In the 23andMe bankruptcy, FTC Chairman Andrew Ferguson wrote in March 2025 about those concerns, saying "Consumers should be able to trust that companies will keep their promises."¹¹

Check: read every privacy notice, employee handbook and customer promise that touched this data. If the notice says you do not share data with third parties, a sale may contradict it. Do not "fix" the notice after the fact.

3. Does it contain employee data?#

Workplace messages are about employees. The Spirit objections show that this is where scrutiny falls first. MIT Technology Review also reports that sale proceeds typically go to senior creditors and investors, not employees, and that there is no federal law banning such sales.¹

California's attorney general says the CCPA exemptions for employment-related information and business-to-business data expired on December 31, 2022.¹² Rules outside the US differ, and we cover the main ones in our research on legal frameworks for selling business data.

Check: whether HR files, payroll, performance notes, medical or accommodation requests, and private messages are in scope. Consider excluding them outright, as SimpleClosure says it does for sensitive employee and health records.¹³

4. Which privacy law applies?#

You do not need to be a lawyer to know which questions to ask. Here are three common regimes, in brief.

HIPAA (US health information). It applies to covered entities and their business associates. They may not sell protected health information except under defined authorizations. Data de-identified under the rule is not treated as protected health information.¹⁴ A regulated entity can de-identify in two ways under 45 CFR 164.514(b): expert determination, where a qualified person concludes the risk of identifying an individual is "very small" and documents it, or safe harbor, where 18 categories of identifiers are removed and there is no actual knowledge that what remains could identify someone.¹⁵

GDPR (EU and UK-style rules). Recital 26 says that to decide whether a person is identifiable you consider "all the means reasonably likely to be used," including cost, time and available technology. Pseudonymised data is still personal data if it can be linked back, and the principles do not apply to truly anonymous data.¹⁶ The UK ICO's guidance adds that identifiability is a spectrum, and it uses a "motivated intruder" test: assume a reasonably competent person with ordinary resources, such as the internet and public records, and see whether they could identify someone. It tells organizations to reassess over time as new datasets and attacks appear.¹⁷

CCPA (California). It gives consumers the right to know, delete and opt out of the sale or sharing of their personal information. It applies to for-profit businesses doing business in California that meet any of three thresholds: more than $25 million in revenue, buying, selling or sharing the data of 100,000 or more California consumers or households, or earning half their revenue from selling personal information.¹² Because the employee and business-to-business exemptions have ended, those categories are in play.

Other states have their own laws. The IAPP counted 19 states with comprehensive privacy laws as of July 2025.¹⁸ We did not verify each state's treatment of employee or de-identified data, so ask.

5. Will de-identification hold?#

De-identification lowers risk and does not remove it. The National Institute of Standards and Technology wrote in 2015 that researchers have shown some de-identified data can still be re-identified.¹⁹ A 2019 Nature Communications paper estimated, with a statistical model, that 99.98% of Americans could be correctly re-identified in a dataset with 15 demographic attributes. That is a model-based estimate, and the paper's body ties the figure to uniqueness in Massachusetts, so it is best read as a warning, not a measured rate for any dataset.²⁰

Free text is harder than a table. A name is easy to remove, but a story about a particular person's day is not. The Spirit union objection about small groups, such as a crew base, is the same issue.³

Check:

• What method is used (rules, models, human review), and what is its measured miss rate on a sample you can inspect?
• Who certifies it, and who pays them? In Spirit's case, the ombudsman wanted a certification filed before every transfer and asked that it state how many passengers' details were found and removed.⁴
• Does the contract bar the buyer from re-identifying and from passing the data on without the same commitment? The ombudsman asked for exactly that.⁴
• Does the process keep records linked across systems? That helps a model learn how work flows, and it also makes re-identification easier, as The Next Web argued.⁵
• Will anyone re-test as new datasets and attacks appear, as the ICO advises?¹⁷

micro1 says it removes personal information "when relevant" and uses synthetic rewrites for some datasets, and lets companies review representative samples before use.⁷ Mercor says its platform extracts and de-identifies data in an automated process and that no AI lab buyer or third-party vendor sees raw data.²¹ Those are statements by the buyers. Ask for the evidence.

6. Who holds the data afterward, and how safe is it?#

A sale moves risk to a new custodian. In March 2026, Mercor confirmed a security incident tied to a supply-chain attack on the open-source LiteLLM library. The extortion group Lapsus$ claimed to have Mercor data and shared a sample that TechCrunch reviewed, which allegedly included material referencing Slack data and apparent ticketing data. Mercor declined to say whether customer or contractor data was accessed.²²

Mercor later said in a June 25, 2026 update that of nearly five million experts only a very limited subset had sensitive information affected, that impact on customer information was very limited, and that no employee data was affected. It also said it had completed an investigation and offered identity protection to notified experts.²³ Several contractor class actions were filed from April 1, according to HR Dive.²⁴

We are not saying Mercor mishandled any company's data. The point is that a buyer's security record matters, and that this is a live example of a data buyer being targeted. The Spirit ombudsman said that if the court considered Mercor's bid, she wanted to examine Mercor's 2026 incident.⁴

Check: where the data will be stored, who can access it, how it is isolated from other clients' data (micro1 says it uses isolated pipelines),⁷ what happens in a breach, and whether you get notice.

7. Is the company in or near bankruptcy?#

Different rules apply. In a US bankruptcy, a trustee generally cannot sell personal information if the debtor promised customers it would not share it with outsiders, unless the sale is consistent with that policy or a consumer privacy ombudsman is appointed and the court approves after a hearing.²⁵ That is what happened at Spirit. We did not find a source on the rules for a non-bankruptcy dissolution, so a lawyer should answer that.

8. What does the contract say?#

The AI Weekly editor's note recommends explicit data-disposition terms in deal documents, for both founders and acquirers.⁸ On a data sale, the clauses to check are:

1. Scope. What data, from when, with which exclusions in writing.
2. Use. Field of use, no re-identification, no onward transfer without equal commitments.
3. Exclusivity. Pebblous notes micro1 has not published its exclusivity wording or its liability and indemnity terms.⁶
4. Security. Standards, audits, breach notice.
5. Deletion. micro1 says data is deleted on request or at the end of the engagement; get that in the contract.⁷
6. Indemnity. Who pays if the data turns out to have been unsellable.
7. Payment. Mercor says payment is by wire after delivery, typically two to four weeks after signing.²¹ Terms differ by buyer.

A scorecard you can use#

Table 1. A quick risk screen. If you answer "no" or "do not know" to a row, stop and resolve it before talking price.

The assessment can help you sort data types before you start, and our main guide goes deeper on rights, privacy and pricing. For the market side, see our look at what is actually documented about broker earnings and the deal tracker.

Bottom line#

"Legally radioactive" is one lawyer's phrase, and it is blunt. It is also a fair summary of what the Spirit fight showed: employees, privacy law and re-identification risk all sit in the same archive. Companies that sell well will be the ones that know their rights first, strip out what they cannot clear, test the de-identification and pin the buyer down in writing.

SellYourAIData has no deals or partnerships with any company named here. This is general information and not legal advice.