# Legal Frameworks for Selling Business Data to AI Developers

Source: https://sellyouraidata.com/research/legal-frameworks-selling-business-data/
Updated: 2026-10-20

## Abstract

**Background:** Companies holding archives of support tickets, chat, email, documents and code are being approached by AI developers that want to license them. The legal position depends on several overlapping regimes, and no single instrument governs the sale.
**Methods:** Desk review of primary legal texts and regulator publications for the EU, UK and US, read in October 2026, supplemented by clearly labelled secondary reporting where primary documents were inaccessible. Sources covered data protection, consumer protection, sector privacy, national security, AI, intellectual property, contract and bankruptcy law.
**Findings:** Across regimes the central questions are whether the data is identifiable, whether the seller's notices and contracts permitted the transfer, whether de-identification meets the applicable standard and can be evidenced, and whether the buyer contract imposes the expected restrictions. Definitions of de-identified data differ materially, the FTC treats retroactive changes to data terms as potentially deceptive, and some orders have required deletion of models built from improperly obtained data.
**Implications:** A sale of business data should be assessed jurisdiction by jurisdiction and by data layer, with documentary evidence for lawful basis, de-identification and contractual restrictions. Several key documents are drafts or secondary reports, and the review is not legal advice.

## 1. Introduction

Companies that hold large archives of internal text, such as support tickets, chat logs, email, documents, call transcripts and code, increasingly receive offers to license those archives to developers of artificial intelligence (AI) systems. This paper addresses a question that precedes price: under which bodies of law is such a transaction permitted, restricted or prohibited, and what obligations travel with the data when it is sold?

The question has no single answer because enterprise archives are legally heterogeneous. A support-ticket export may contain customer personal data collected under a privacy notice, confidential information belonging to the customer's employer, employee data about the support agents, and third-party copyrighted attachments. Each layer is governed by a different instrument, and the one that binds tightest usually determines what can be sold.

This review organises the primary sources into a map covering EU and UK data protection law, US state privacy statutes, FTC enforcement, sector rules for health, financial and education records, national-security rules on bulk data, the EU AI Act, copyright and database rights, contract law, employee data, and sales of customer data in bankruptcy. It is a source review, not legal advice. Statutes change, and several documents cited here are drafts, pre-publication versions or guidance their authors describe as under review.
## 2. Methods and sources

The review used primary legal texts and regulator publications wherever available: statutes and regulations (the GDPR, the California Consumer Privacy Act as published by the California Privacy Protection Agency, the Bankruptcy Code, the HIPAA Privacy Rule, the Gramm-Leach-Bliley Act and FERPA regulations, the EU AI Act and the Database Directive), regulator opinions and guidance (the European Data Protection Board, the UK Information Commissioner's Office, the Federal Trade Commission, the Department of Health and Human Services, the Department of Justice and the US Copyright Office), and reporting on proceedings where the primary filing could not be accessed. Secondary sources are identified as such in the text.

Sources were opened and read in October 2026, with a final verification pass on 20 October 2026. Statutory text came from the official publisher where accessible and otherwise from widely used unofficial reproductions (Cornell Law School's Legal Information Institute for US federal materials and Intersoft Consulting for the GDPR), which may lag amendments. The HHS de-identification guidance was read from an archived copy of the official page. The Spirit Airlines proceedings (Section 3.10) were ongoing, and the outcome of the hearing scheduled for 14 October 2026 was not verified.

Inclusion required relevance to a business licensing a dataset that may contain personal data, confidential information or third-party content to an AI developer. The review excludes tax, antitrust, securities law, export controls other than the Department of Justice bulk data rule, and the law of jurisdictions outside the United States, the European Union and the United Kingdom.
## 3. Findings

### 3.1 The threshold question: is the data personal data?

Nearly every regime reviewed turns first on whether the dataset relates to an identifiable person. If not, many rules fall away. If so, the seller needs a lawful basis, notice, contractual controls and often additional safeguards.

Under the GDPR, personal data is any information relating to an identified or identifiable natural person, identifiable directly or indirectly by reference to a name, identification number, location data or online identifier.[^1] Pseudonymisation means processing so that data can no longer be attributed to a specific person without additional information that is kept separately under technical and organisational measures.[^1] Recital 26 states that pseudonymised data attributable to a person using additional information remains information on an identifiable person, that identifiability is assessed by "all the means reasonably likely to be used" by the controller or another person, including cost, time and available technology, and that the principles do not apply to anonymous information.[^2]

Two European developments sharpen the test. The EDPB's January 2025 draft guidelines on pseudonymisation state that pseudonymised data remains personal data even where the additional information is held by someone else, and that even if all additional information is erased, the data is anonymous only if the conditions for anonymity are actually met.[^3] The guidelines were adopted as a version for public consultation; whether a final text exists was not verified. On 4 September 2025 the Court of Justice decided EDPS v SRB (Case C-413/23 P). According to a law firm analysis, the Court held that pseudonymised data is not necessarily personal data for every recipient: if a recipient cannot re-identify individuals by means reasonably likely to be used, it is not personal data in that recipient's hands, but the assessment is recipient by recipient and can change over time.[^4] The analysis adds that the judgment gives no quantitative anonymisation threshold and does not address whether contractual re-identification bans reduce risk.[^4] The judgment itself was not read. A seller holds the original records, so its own re-identification capability remains relevant to the transfer.

The UK Information Commissioner's Office (ICO) describes identifiability as a spectrum, points to "the means reasonably likely to be used," and recommends a "motivated intruder" test as a starting point; it says purely hypothetical chances of identification need not be considered, and that its guidance is under review following the Data (Use and Access) Act.[^5]

In the United States there is no single definition. Section 1798.140 of the California Consumer Privacy Act (CCPA) defines "deidentified" information as information that cannot reasonably be used to infer information about, or be linked to, a particular consumer, provided the business takes reasonable measures to prevent association with a consumer or household, publicly commits to keep it deidentified and not to re-identify it (except to test its own processes), and contractually obligates recipients to the same conditions.[^6] HIPAA has two formal routes (Section 3.5). The Department of Justice bulk data rule (Section 3.6) counts data as covered whether it is anonymized, pseudonymized, de-identified or encrypted.[^7]
### 3.2 EU and UK data protection law
#### 3.2.1 Controllers, processors and the seller's role

A company selling a dataset of personal data to an AI developer is, under the GDPR, almost certainly a controller making a disclosure to a third party, which is a processing operation requiring a lawful basis. A controller determines the purposes and means of processing; a processor processes on its behalf.[^1] Under Article 28 a processor may act only on documented instructions, must be bound by a contract setting out the subject matter, duration, nature and purpose of processing, and is treated as a controller if it determines purposes and means in breach of the Regulation.[^8]

If the developer receives data to train its own model for its own commercial purposes, it determines the purposes and is a controller, so the seller cannot characterise it as a mere processor. A vendor that de-identifies the data for the seller is a processor. Reporting on the Spirit Airlines proceedings (Section 3.10) describes both structures in one transaction.[^9]
#### 3.2.2 Purpose limitation and compatibility

Article 5(1)(b) requires that personal data be collected for specified, explicit and legitimate purposes and not further processed incompatibly, with archiving, research and statistical purposes treated as not incompatible subject to Article 89(1).[^10] Where the new purpose rests on neither consent nor specific law, Article 6(4) lists compatibility factors: any link between the purposes, the context of collection and the relationship between data subject and controller, the nature of the data (including special categories), the possible consequences for data subjects, and safeguards such as encryption or pseudonymisation.[^11]

Selling support transcripts to an AI developer changes the purpose for which they were collected. The factors do not make that impossible, but those on context and consequences are demanding: a customer who contacted support about a billing dispute is unlikely to expect from the original notice that the conversation would be sold. Whether commercial licensing can be framed as compatible is fact-specific and this review does not resolve it. The EDPB's pseudonymisation draft notes that pseudonymisation can help establish compatibility under Article 6(4) but is rarely sufficient alone.[^3]
#### 3.2.3 EDPB Opinion 28/2024 on AI models

On 17 December 2024 the EDPB adopted Opinion 28/2024, requested by the Irish supervisory authority, on personal data in AI model development and deployment.[^12] On anonymity, it states that AI models trained on personal data cannot in all cases be considered anonymous; for anonymity, both the likelihood of direct (including probabilistic) extraction of personal data about individuals in the training data and the likelihood of obtaining it from queries must be insignificant, taking into account all the means reasonably likely to be used.[^12] On legal basis, it restates the three-step legitimate interest test (identify the interest, assess necessity, balance against data subjects' rights) and stresses reasonable expectations, including whether data was public, the relationship with the controller and the context of collection.[^12]

On unlawful development, where personal data is retained in a model and processed by another controller in deployment, authorities should consider whether that controller carried out an appropriate assessment, under its accountability duties, that the model was not developed by unlawfully processing personal data, looking at the source of the data and any finding of infringement.[^12] Where a model is anonymised before deployment and subsequent operation does not process personal data, the GDPR would not apply to that operation.[^12]

For sellers, buyers that develop models are expected to scrutinise training data provenance, so due diligence requests for evidence of lawful basis, notices and de-identification should be anticipated, and the Opinion has supervisory authorities review the controller's documentation when assessing a claim of anonymity.
#### 3.2.4 The United Kingdom

The UK GDPR retains the same core definitions. The ICO's guidance on AI and data protection, last updated on 15 March 2023, is described as under review following the Data (Use and Access) Act.[^13] Its anonymisation guidance adds that organisations should consider both the information and who may get or want access to it, and that releases to the world at large carry higher risk than controlled releases to known recipients.[^5] A controlled release to one contracted buyer is therefore a different risk profile from publication, though the SRB analysis notes the CJEU did not address whether contract terms reduce identifiability.[^4]
### 3.3 United States state privacy laws

#### 3.3.1 Prevalence

The International Association of Privacy Professionals (IAPP) reports that 19 US states had enacted comprehensive privacy laws as of July 2025, listing California (2018), Virginia and Colorado (2021), Utah and Connecticut (2022), Delaware, Indiana, Iowa, Montana, Oregon, Tennessee and Texas (2023), and New Hampshire, New Jersey, Kentucky, Maryland, Minnesota, Nebraska and Rhode Island (2024); its page, last updated on 27 October 2025, notes that no new states were added in 2025 although eight amended their laws.[^14] Because the figure changes with legislative sessions, sellers should check the current count and effective dates rather than rely on this snapshot.

#### 3.3.2 "Sale" and "sharing" under the CCPA

The CCPA defines "sell" broadly as selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information by a business to a third party "for monetary or other valuable consideration."[^6] A data licensing agreement under which a business discloses consumer personal information to an AI developer in exchange for payment fits that definition on its face, so a business that licenses identifiable consumer data would be selling personal information and would owe the notice and opt-out obligations that attach to sale, including the right to opt out under Section 1798.120.[^6] "Share" is a separate defined term limited to disclosure for cross-context behavioral advertising, and so is less likely to apply to AI training licences.[^6]

The statute carves out several transfers from "sale", including a consumer's direction to disclose, and the transfer of personal information "as an asset that is part of a merger, acquisition, bankruptcy, or other transaction" in which a third party assumes control of all or part of the business, provided the information is used or shared consistently with the title. That carve-out does not authorise material, retroactive privacy policy changes, and a third party that materially alters its use inconsistently with promises made at collection must give prior notice.[^6] This language is relevant to Section 3.10.

The CCPA also imposes a purpose-proportionality duty: a business's collection, use, retention and sharing of personal information must be reasonably necessary and proportionate to the purposes for which it was collected or processed, or for another disclosed purpose compatible with the context of collection, and not further processed in an incompatible manner.[^6] This parallels the GDPR's purpose limitation principle. The statute excludes from "personal information" publicly available information, defined as information lawfully made available from government records or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.[^6]

#### 3.3.3 Deidentified data as an exit route

Because the CCPA's deidentified definition is process-based, a business can aim to place a dataset outside "personal information" by meeting each condition.[^6] The contractual condition matters most in a licence: the seller must obligate every recipient to the same commitments, in practice a no-re-identification clause with flow-down to onward recipients. The CCPA's employee exemptions were stated to become inoperative on 1 January 2023, so employee data in an archive can be personal information of California residents.[^6] Other states differ, and this review did not compare them clause by clause.
### 3.4 FTC Act Section 5 and algorithmic disgorgement

Section 5 of the FTC Act prohibits unfair or deceptive acts or practices.[^15] The Federal Trade Commission (FTC) has no AI-specific privacy statute; it applies Section 5 to what companies say and do with data. Three strands matter to a company selling its archives.

The first is retroactive change of terms. In a February 2024 post, FTC staff wrote that it may be unfair or deceptive for a company to adopt more permissive data practices, such as sharing data with third parties or using it for AI training, and to tell consumers only through a surreptitious, retroactive amendment to its terms or privacy policy.[^16] The post cites earlier cases involving a children's education company that changed its privacy policy to share data without notice or consent and a 2023 case against a genetic testing company.[^16] A January 2024 post adds that commitments count wherever made, that omitting material facts can be treated like explicit misrepresentation, and that companies may not promise they "won't use customer data for secret purposes, such as to train or update their models" and then do so.[^17] Updating a privacy policy at the time of a data deal does not, by itself, cure data collected under the old promises.

The second is deletion of products built from improperly obtained data, often called algorithmic disgorgement. In *Everalbum* (finalized May 2021) the FTC alleged a photo app enabled facial recognition by default contrary to its representations and kept photos of deactivated accounts; the order required deletion of those photos and of models and algorithms developed from users' uploaded content.[^18] In March 2022 a settlement with WW International and Kurbo, Inc. over collecting children's data without parental consent required deletion of the data, destruction of derived algorithms and a $1.5 million civil penalty.[^19] In December 2023 the FTC announced a proposed order against Rite Aid over AI facial recognition that would ban such surveillance use for five years and require deletion of images and any algorithms or products developed from them.[^20]

These cases involved a company's own collection and use, not sale to a model developer, but they show a remedy that follows the data into downstream products. A buyer that trains on improperly obtained data risks losing the model, so careful buyers ask sellers to warrant lawful collection and notices that permitted the transfer. This review expresses no view on whether the FTC would pursue a seller in a pure licensing context.

The third strand is the FTC's view that AI companies' privacy and confidentiality commitments are enforceable, and that it has required deletion of models built from unlawfully obtained data.[^17]
### 3.5 Sector statutes: HIPAA, GLBA and FERPA

#### 3.5.1 HIPAA

The HIPAA Privacy Rule generally prohibits a covered entity or business associate from selling protected health information (PHI) without authorisation, where "sale" means a disclosure for which the entity receives remuneration from or on behalf of the recipient in exchange for the PHI, subject to exceptions.[^21] A covered entity may use PHI to create de-identified information, and information de-identified under 45 CFR 164.514(a) and (b) falls outside the Privacy Rule.[^21]

Section 164.514(b) provides two methods. Under Expert Determination, a person with appropriate knowledge of generally accepted statistical and scientific principles determines that the risk is very small that the information could be used, alone or with other reasonably available information, by an anticipated recipient to identify an individual, and documents the methods and results.[^22] Under Safe Harbor, 18 categories of identifiers of the individual and of relatives, employers or household members must be removed (including names, geographic subdivisions smaller than a state, date elements other than year, telephone and fax numbers, email addresses, Social Security and medical record numbers, account numbers, device identifiers, URLs, IP addresses, biometric identifiers, full-face photographs and any other unique identifying number, characteristic or code), and the entity must have no actual knowledge that the remainder could identify an individual.[^22]

HHS Office for Civil Rights guidance states that no explicit numerical level of risk universally meets the "very small" standard; that the Privacy Rule does not limit disclosure of de-identified information although a data use agreement prohibiting re-identification may be required by the entity; and that the standard makes no distinction between structured fields and free text, so a listed identifier must be removed wherever it appears if recognizable as one.[^23] The guidance observes that clinical narratives are information rich and may allow patient identification from context.[^23] For text archives from healthcare customers, the free-text point is critical; the companion paper in this series covers detection performance. HIPAA does not reach every holder of health information, and state health data laws were not analysed.
#### 3.5.2 GLBA

The Gramm-Leach-Bliley Act, at 15 U.S.C. 6802, restricts financial institutions from disclosing nonpublic personal information to nonaffiliated third parties unless they have provided notice and an opportunity to opt out, subject to statutory exceptions.[^24] A financial institution that holds customer transaction or application records in text form and wishes to license them would need to consider this provision and its exceptions with counsel. This review did not analyse the implementing regulations or state financial privacy laws.

#### 3.5.3 FERPA

The Family Educational Rights and Privacy Act regulations permit an educational agency or institution, or a party that has received education records, to release records after removing all personally identifiable information, provided it has made a reasonable determination that a student's identity is not personally identifiable, whether through single or multiple releases and taking into account other reasonably available information.[^25] The regulation also provides for release of de-identified student-level data for education research with a re-identification code, subject to conditions.[^25] Education technology vendors that hold student communications should treat FERPA and applicable state student privacy laws as a threshold issue before any licence.

### 3.6 National security rules on bulk data transfers

The Department of Justice final rule implementing Executive Order 14117 restricts or prohibits US persons from certain data transactions with six countries of concern and covered persons.[^7] It prohibits data brokerage and transactions involving bulk human 'omic data or biospecimens, restricts vendor, employment and non-passive investment agreements, and requires US persons engaged in data brokerage with a foreign person who is not a covered person to satisfy conditions, including contractually requiring that the foreign person not resell or provide access to the data to a country of concern or covered person.[^7]

The rule applies to "bulk" volumes over the preceding 12 months: human genomic data on over 100 US persons, other 'omic data and biometric identifiers on over 1,000, precise geolocation on over 1,000 devices, personal health and financial data on over 10,000, and certain covered personal identifiers on over 100,000.[^7] The DOJ fact sheet states that bulk applies "whether the data is anonymized, pseudonymized, de-identified, or encrypted."[^7] The bulk definition is codified at 28 CFR 202.205.[^26] The fact sheet states the rule takes effect 90 days after Federal Register publication with certain obligations phased in at 270 days, and that willful violations can lead to criminal fines up to $1,000,000 and up to 20 years of imprisonment.[^7]

For a seller of enterprise text, exposure depends on whether the archive holds covered categories at the thresholds and whether any buyer or downstream entity is a covered person. The contract flow-down is the most relevant element for a US seller licensing to non-covered foreign buyers. Current text and amendments were not verified.
### 3.7 EU AI Act, copyright and database rights

#### 3.7.1 AI Act training data transparency

Article 53 of the EU AI Act imposes obligations on providers of general-purpose AI (GPAI) models, in force from 2 August 2025 according to Article 113(b): technical documentation, information for downstream providers, a policy to comply with EU copyright law including reservations of rights under Article 4(3) of Directive (EU) 2019/790, and a publicly available "sufficiently detailed summary about the content used for training" in the AI Office template.[^27]

A law firm summary of the Commission's template (published 24 July 2025) says it uses six source categories: public datasets, licensed private datasets, crawled or scraped data, user data, synthetic data and other data; that for licensed data providers need only confirm whether licensing agreements exist and state the modalities; and that enforcement can begin from 2 August 2026, with earlier models having until 2 August 2027.[^28] The official template was not read, and the summary does not address personal data. The implication for sellers is indirect: buyers who are GPAI providers must account for training sources and will ask for provenance and licensing documentation.
#### 3.7.2 Copyright and the licensing market

Enterprise archives often contain third-party material such as attachments, quoted articles and open source code. The US Copyright Office's May 2025 pre-publication report on generative AI training examines fair use under 17 U.S.C. 107. It states that knowing use of pirated or illegally accessed works should weigh against fair use without being determinative, that where licensing markets are available unlicensed uses will be disfavored under the fourth factor (though where barriers to licensing prove insurmountable there may be no market to harm), and that direct licensing is most promising for corporate entities with catalogs of high-quality, easily identifiable content.[^29] The Office said no substantive changes were expected in the final version, which this review did not verify.

The report is advisory analysis on fair use, not a judicial holding, and does not address privacy. Its practical relevance is that a seller that can document its rights in the content it supplies reduces the buyer's infringement risk. Employee-authored work product is typically owned by the employer, but customer-supplied content in tickets and documents may not be, a question governed by the agreements in Section 3.8.
#### 3.7.3 EU database rights

Article 7(1) of the Database Directive (96/9/EC) grants the maker of a database that shows a qualitatively or quantitatively substantial investment in obtaining, verifying or presenting its contents the right to prevent extraction and re-utilisation of the whole or a substantial part of the contents.[^30] The Directive's recitals state that the sui generis right does not extend copyright protection to mere facts or data and should not create a new right in the works, data or materials themselves.[^30] For a seller in the EU, the right provides a basis to license a structured database as an asset and to restrict onward extraction, but it protects the investment in the database, not the facts or the personal data inside it, and it does not displace data protection law. The case law of the Court of Justice on what counts as qualifying investment was not reviewed here.

### 3.8 Contract law: customer agreements, confidentiality and data ownership

Much of the law governing a sale is private. The seller's contracts with customers, vendors and employees determine what it may sell, and no regulator's guidance overrides a confidentiality clause.

Four categories warrant review. Customer agreements often define customer data, ownership, permitted vendor uses (frequently limited to providing the service) and confidentiality; a clause permitting use of aggregated or anonymised data for product improvement may not extend to licensing for model training, depending on its text. Data processing agreements under GDPR Article 28 bind the processor to documented instructions, so a vendor acting as a processor is generally not free to sell its customers' data.[^8] Vendor and platform terms may restrict extraction and reuse. Employment agreements and workplace policies may restrict use of employee communications (Section 3.9).

Contract-based theories are developing in the AI context. In a complaint filed on 4 June 2025 in San Francisco Superior Court, Reddit sued Anthropic alleging, among other claims, breach of its user agreement and robots.txt directives, citing its licensing agreements with other AI companies that include content usage and deletion terms. These are allegations as reported by a news outlet; the complaint and the case status were not verified.[^31]

Contracts are also how several statutes operate: the CCPA requires contractual flow-down of deidentification commitments,[^6] the DOJ rule requires contractual limits on onward transfer,[^7] and HHS notes a data use agreement may prohibit re-identification.[^23] Typical protective terms include no re-identification or linkage, onward transfer limits, audit rights, security duties, deletion on termination, warranties of lawful collection and indemnities. Whether any term is enforceable or market-standard is outside this review.
### 3.9 Employee data and communications

Archives of internal email, chat and call recordings contain employees' personal data and may reflect monitoring employees did not expect. Article 88 GDPR lets Member States adopt more specific employment rules, which must include suitable measures to safeguard human dignity and fundamental rights with particular regard to transparency and workplace monitoring systems.[^32] The ICO's monitoring workers guidance is aimed at helping employers comply with the UK GDPR and protect workers' rights.[^33]

In *Bărbulescu v. Romania* (5 September 2017) the Grand Chamber of the European Court of Human Rights found a violation of Article 8 because national courts had not determined whether the employee received prior notice of possible monitoring, nor considered its nature and extent and the reasons justifying it.[^34] The case concerned monitoring and dismissal, not data sales, but it illustrates why communications collected under a monitoring notice cannot necessarily be repurposed for commercial licensing.

In the United States, the CCPA's employee exemptions lapsed on 1 January 2023.[^6] In the Spirit Airlines proceedings, reporting says unions representing pilots and flight attendants, and a software company, objected to the sale, and that the ombudsman's report did not assess risks to employees or third parties.[^9]
### 3.10 Bankruptcy sales of customer data

Enterprise data is sometimes sold when its holder is insolvent. Section 363(b)(1) of the Bankruptcy Code lets a trustee sell estate property outside the ordinary course after notice and a hearing, but if the debtor disclosed a policy prohibiting transfer of personally identifiable information to unaffiliated persons and that policy was in effect at the commencement of the case, the trustee may not sell such information unless the sale is consistent with the policy or the court approves it after appointing a consumer privacy ombudsman and holding a hearing.[^35]

In May 2015 the FTC's Consumer Protection Director wrote to the ombudsman in the RadioShack bankruptcy recommending that customer data not be sold on its own, go only to a buyer in substantially the same line of business, be used under the privacy policies in effect at collection, and be used for materially different purposes only after notice and consent, modelled on the earlier Toysmart.com settlement.[^36] In March 2025 the FTC Chairman wrote to the US Trustee expressing concern about a potential sale of consumers' 23andMe data.[^37] Outcomes were not verified.

The most recent example is Spirit Airlines. According to an October 9, 2026 news report, Google won an August auction for a package of deidentified Spirit data with a $10 million bid, an AI training company filed a competing $12.5 million bid on 3 September, and the court-appointed ombudsman recommended approval in a report filed on 5 October, finding that agreed exclusions and safeguards eliminated or mitigated privacy costs to consumers.[^9] Reported conditions included de-identification of corporate email by a vendor hired by Spirit, certification to the court before each transfer, and a buyer commitment not to re-identify and to pass the data on only to recipients making the same commitment; passenger booking and transaction records were reported as excluded.[^9] A hearing was set for 14 October 2026; the outcome was not verified, and the report is secondary.

The structural lesson for solvent sellers is that privacy-policy purpose restrictions are treated as binding commitments, and the typical solution combines exclusion of the most sensitive categories, independent de-identification, certification and contractual no-re-identification terms.
### 3.11 Summary of obligations

**Table 1.** Selected laws and the main obligations or constraints they create for a business selling data to an AI developer.

| Law or source | Key obligations or constraints |
|---|---|
| GDPR (EU), Arts. 5, 6, 28[^10][^11][^8] | Lawful basis; purpose limitation and Art. 6(4) compatibility; processor contracts; anonymity judged by means reasonably likely to be used |
| EDPB Opinion 28/2024[^12] | Model anonymity not presumed; legitimate interest three-step test; buyers expected to assess lawfulness of source data |
| UK GDPR and ICO guidance[^5][^13] | Same core principles; motivated intruder test; guidance under review |
| CCPA / CPRA[^6] | Sale means disclosure for valuable consideration; notice and opt-out; deidentified data needs three conditions; proportionality |
| Other US state laws[^14] | Varying sale definitions and opt-outs; 19 states in the IAPP snapshot |
| FTC Act Section 5[^15][^16][^18] | Honour privacy promises; no surreptitious retroactive changes; model deletion in some orders |
| HIPAA Privacy Rule[^21][^22] | No sale of PHI without authorisation; de-identify by Expert Determination or Safe Harbor |
| GLBA[^24] | Notice and opt-out before disclosure to nonaffiliated third parties |
| FERPA[^25] | De-identification with reasonable determination; research release conditions |
| DOJ bulk data rule[^7] | Prohibits data brokerage to covered persons; contractual flow-down for other foreign buyers; covers de-identified data |
| EU AI Act Art. 53[^27] | Buyer-side: public training content summary; copyright policy; documentation |
| Copyright and database rights[^29][^30] | US fair use analysis; EU sui generis right protects investment in databases, not facts |
| Bankruptcy Code 363(b)(1)[^35] | Consumer privacy ombudsman and court approval if sale contradicts the debtor's privacy policy |

## 4. Discussion

Three themes emerge. First, legal weight rests on what the seller promised at collection, not on what the buyer intends. The FTC's retroactive-change post, GDPR purpose limitation, the CCPA proportionality duty and the Bankruptcy Code's privacy-policy trigger all anchor the analysis in the seller's original statements and data subjects' expectations. An archive collected under a narrow notice is the hardest to license, and by the FTC's stated position the notice cannot be fixed by amending the text on the day of sale.

Second, de-identification is a means to an end, defined differently in each regime and never self-certifying. The GDPR and ICO ask about means reasonably likely to be used; the CCPA adds a public commitment and contract; HIPAA offers prescriptive routes but no numeric risk level; the DOJ rule ignores the label. A seller that de-identifies to one standard has not necessarily met another, and the EDPB's position that anonymity must be demonstrated, with the CJEU's recipient-specific reading of pseudonymised data, makes documentation central.

Third, the transaction is a chain of controls: lawful basis, de-identification, contractual restrictions on the buyer, the buyer's own duties under the AI Act, and the possibility of remedy by deletion. The Spirit Airlines matter, as reported, combines each, but it is a reported case, not an established standard. Real uncertainty remains over whether commercial licensing for AI training can be a compatible purpose under GDPR Article 6(4), how the CCPA treats a licence to a buyer with no re-identification capability, and how state variation and pending amendments affect the analysis.
## 5. Limitations

This is a desk review of published sources, not a legal opinion, and no lawyer has checked it in any jurisdiction. Statutory text came from public reproductions that may not reflect the latest amendments. Several documents are drafts or pre-publication versions (the EDPB pseudonymisation guidelines and the Copyright Office report). The CJEU judgment in EDPS v SRB, the Commission's training content template, the Reddit complaint and the Spirit Airlines filings were reported through law firm analyses or news outlets and not read in primary form. The review omits other countries, state data broker registration regimes, biometric statutes and children's privacy law except where noted. The IAPP state count is a snapshot from July 2025 and may be out of date as of October 2026. Developments after the dates of the sources, including the October 2026 Spirit Airlines hearing, were not verified.
## 6. Conclusion

The law governing the sale of business data to AI developers is a patchwork in which the strictest applicable rule usually controls. Four questions recur across the sources: whether the data relates to an identifiable person; whether the seller's notices and contracts permitted this use; whether de-identification meets the relevant regime's standard and can be evidenced; and whether the buyer contract imposes the restrictions that statutes and regulators expect. Direct regulatory signals on AI specifically are thin but growing, led by the EDPB Opinion, FTC statements and orders, the AI Act's transparency rules and the Copyright Office analysis. Any transaction needs advice from qualified counsel in each relevant jurisdiction, because this paper summarises sources and does not apply them to facts.

[^1]: [Art. 4 GDPR: Definitions](https://gdpr-info.eu/art-4-gdpr/) (Intersoft Consulting, unofficial text of Regulation (EU) 2016/679, accessed October 2026)
[^2]: [Recital 26: Not applicable to anonymous data](https://gdpr-info.eu/recitals/no-26/) (Intersoft Consulting, unofficial text of Regulation (EU) 2016/679, accessed October 2026)
[^3]: [Guidelines 01/2025 on Pseudonymisation (version for public consultation)](https://www.edpb.europa.eu/system/files/2025-01/edpb_guidelines_202501_pseudonymisation_en.pdf) (European Data Protection Board, January 2025)
[^4]: [Pseudonymized data after EDPS v SRB](https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2025/09/pseudonymized-data-after-edps-v-srb.html) (Clifford Chance, September 2025)
[^5]: [How do we ensure anonymisation is effective?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/) (Information Commissioner's Office, accessed October 2026)
[^6]: [California Consumer Privacy Act of 2018, as amended (statutory text)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) (California Privacy Protection Agency, accessed October 2026)
[^7]: [Fact Sheet: Justice Department Issues Final Rule to Address Urgent National Security Risks Posed by Access to U.S. Sensitive Personal and Government-Related Data](https://www.justice.gov/opa/media/1382526/dl) (US Department of Justice, accessed October 2026)
[^8]: [Art. 28 GDPR: Processor](https://gdpr-info.eu/art-28-gdpr/) (Intersoft Consulting, unofficial text of Regulation (EU) 2016/679, accessed October 2026)
[^9]: [Spirit's privacy ombudsman backs Google's $10m data deal](https://thenextweb.com/news/google-spirit-airlines-data-ombudsman-approval) (The Next Web, October 2026)
[^10]: [Art. 5 GDPR: Principles relating to processing of personal data](https://gdpr-info.eu/art-5-gdpr/) (Intersoft Consulting, unofficial text of Regulation (EU) 2016/679, accessed October 2026)
[^11]: [Art. 6 GDPR: Lawfulness of processing](https://gdpr-info.eu/art-6-gdpr/) (Intersoft Consulting, unofficial text of Regulation (EU) 2016/679, accessed October 2026)
[^12]: [Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models](https://edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf) (European Data Protection Board, December 2024)
[^13]: [Guidance on AI and data protection](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/) (Information Commissioner's Office, updated March 2023)
[^14]: [US State Privacy Laws Overview](https://iapp.org/resources/article/us-state-privacy-laws-overview) (International Association of Privacy Professionals, October 2025)
[^15]: [15 U.S. Code 45: Unfair methods of competition unlawful](https://www.law.cornell.edu/uscode/text/15/45) (Cornell Law School Legal Information Institute, accessed October 2026)
[^16]: [AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) (Federal Trade Commission, February 2024)
[^17]: [AI Companies: Uphold Your Privacy and Confidentiality Commitments](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/01/ai-companies-uphold-your-privacy-confidentiality-commitments) (Federal Trade Commission, January 2024)
[^18]: [FTC Finalizes Settlement with Photo App Developer Related to Misuse of Facial Recognition Technology](https://www.ftc.gov/news-events/news/press-releases/2021/05/ftc-finalizes-settlement-photo-app-developer-related-misuse-facial-recognition-technology) (Federal Trade Commission, May 2021)
[^19]: [FTC Takes Action Against Company Formerly Known as Weight Watchers for Illegally Collecting Kids' Sensitive Health Data](https://www.ftc.gov/news-events/news/press-releases/2022/03/ftc-takes-action-against-company-formerly-known-weight-watchers-illegally-collecting-kids-sensitive) (Federal Trade Commission, March 2022)
[^20]: [Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology Without Reasonable Safeguards](https://www.ftc.gov/news-events/news/press-releases/2023/12/rite-aid-banned-using-ai-facial-recognition-after-ftc-says-retailer-deployed-technology-without) (Federal Trade Commission, December 2023)
[^21]: [45 CFR 164.502: Uses and disclosures of protected health information, general rules](https://www.law.cornell.edu/cfr/text/45/164.502) (Cornell Law School Legal Information Institute, accessed October 2026)
[^22]: [45 CFR 164.514: Other requirements relating to uses and disclosures of protected health information](https://www.law.cornell.edu/cfr/text/45/164.514) (Cornell Law School Legal Information Institute, accessed October 2026)
[^23]: [Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html) (HHS Office for Civil Rights, read from an archived copy, October 2026)
[^24]: [15 U.S. Code 6802: Obligations with respect to disclosures of personal information](https://www.law.cornell.edu/uscode/text/15/6802) (Cornell Law School Legal Information Institute, accessed October 2026)
[^25]: [34 CFR 99.31: Under what conditions is prior consent not required to disclose information?](https://www.law.cornell.edu/cfr/text/34/99.31) (Cornell Law School Legal Information Institute, accessed October 2026)
[^26]: [28 CFR 202.205: Bulk](https://www.law.cornell.edu/cfr/text/28/202.205) (Cornell Law School Legal Information Institute, accessed October 2026)
[^27]: [Article 53: Obligations for Providers of General-Purpose AI Models](https://artificialintelligenceact.eu/article/53/) (EU Artificial Intelligence Act, unofficial text, accessed October 2026)
[^28]: [EU AI Act News: Rules on General-Purpose AI Start Applying, Guidelines and Template for Summary of Training Data Finalized](https://www.mayerbrown.com/ja/insights/publications/2025/08/eu-ai-act-news-rules-on-general-purpose-ai-start-applying-guidelines-and-template-for-summary-of-training-data-finalized) (Mayer Brown, August 2025)
[^29]: [Copyright and Artificial Intelligence, Part 3: Generative AI Training (pre-publication version)](https://www.copyright.gov/ai/Copyright-and-Artificial-Intelligence-Part-3-Generative-AI-Training-Report-Pre-Publication-Version.pdf) (US Copyright Office, May 2025)
[^30]: [Directive 96/9/EC on the legal protection of databases](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:31996L0009) (EUR-Lex, March 1996)
[^31]: [Reddit sues Anthropic over alleged scraping and commercial use of user data](https://siliconangle.com/2025/06/04/reddit-sues-anthropic-alleged-scraping-commercial-use-user-data/) (SiliconANGLE, June 2025)
[^32]: [Art. 88 GDPR: Processing in the context of employment](https://gdpr-info.eu/art-88-gdpr/) (Intersoft Consulting, unofficial text of Regulation (EU) 2016/679, accessed October 2026)
[^33]: [Employment practices and data protection: monitoring workers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/) (Information Commissioner's Office, accessed October 2026)
[^34]: [Factsheet: Surveillance at workplace (Bărbulescu v. Romania, Grand Chamber, 5 September 2017)](https://www.echr.coe.int/documents/d/echr/fs_workplace_surveillance_eng) (European Court of Human Rights, accessed October 2026)
[^35]: [11 U.S. Code 363: Use, sale, or lease of property](https://www.law.cornell.edu/uscode/text/11/363) (Cornell Law School Legal Information Institute, accessed October 2026)
[^36]: [FTC Requests Bankruptcy Court Take Steps to Protect RadioShack Consumers' Personal Information](https://www.ftc.gov/news-events/news/press-releases/2015/05/ftc-requests-bankruptcy-court-take-steps-protect-radioshack-consumers-personal-information) (Federal Trade Commission, May 2015)
[^37]: [FTC Chairman Andrew N. Ferguson Issues Letter on 23andMe Bankruptcy and Impact on Consumer Data](https://www.ftc.gov/news-events/news/press-releases/2025/03/federal-trade-commission-chairman-andrew-n-ferguson-issues-letter-23andme-bankruptcy-impact) (Federal Trade Commission, March 2025)

## FAQ

**Can a company sell customer data to an AI developer under GDPR?**

Selling identifiable personal data is a processing operation that needs a lawful basis and must satisfy purpose limitation, including the Article 6(4) compatibility factors. Data that is genuinely anonymous falls outside the GDPR, but regulators expect the anonymity claim to be demonstrated. This review does not resolve whether licensing can be a compatible purpose in a given case.

**Is licensing data to an AI company a 'sale' under the CCPA?**

The CCPA defines sale as disclosing personal information to a third party for monetary or other valuable consideration, so a paid licence of identifiable consumer data appears to fit. Information that meets the statute's deidentified definition, including a public commitment and recipient contracts, is outside personal information.

**Can a company change its privacy policy to allow AI training on existing data?**

FTC staff stated in February 2024 that adopting more permissive data practices and notifying consumers only through a surreptitious, retroactive change to terms or privacy policy may be unfair or deceptive.

**Does HIPAA de-identification cover free text?**

Yes. HHS guidance says the standard makes no distinction between structured fields and free text, so listed identifiers must be removed wherever they appear if recognizable as identifiers.

**What happens to customer data when a company goes bankrupt?**

Under Bankruptcy Code section 363(b)(1), if the debtor had a policy prohibiting transfer of personally identifiable information, a sale generally requires consistency with that policy or court approval after a consumer privacy ombudsman is appointed.