Do companies sell employee data? What the law allows

By Cody Houser, Founder · Last updated October 24, 2026

The short answer: some companies do, mainly by licensing email and chat archives to AI developers, but they can’t do it freely. In California, employee data has been covered by the CCPA since January 1, 2023. The GDPR covers employee messages in the EU. The privacy notices a company gave, its contracts, labor law, and platform terms all limit what it can share, and identifying data must usually be removed or excluded.

This guide covers both sides: what owners need to know before licensing records that mention employees and customers, and what employees can do if they’re concerned. It explains the rules; it isn’t legal advice.

Why this is coming up now

AI developers want internal operational data, such as Slack or Teams messages, documents, and tickets. Frankfurt Kurnit reports that startups shutting down have been selling Slack archives, email, and Jira tickets to AI developers, and that operating companies “are now getting the same calls.” Those archives are full of information about people: employees, former employees, customers, and partners.

What counts as “selling” personal data

Under California’s CCPA, Civil Code § 1798.140, a sale is broader than a cash purchase. It covers “selling, renting, releasing, disclosing, disseminating, making available, transferring” personal information to a third party “for monetary or other valuable consideration.” A data license for AI training fits that description if the data is still personal.

Data falls outside the definition only if it is “deidentified,” meaning it can’t reasonably be linked to a particular person and the business (1) takes reasonable measures to keep it that way, (2) publicly commits not to re-identify it, and (3) contractually obligates recipients to do the same. Free-text email and chat are hard to bring to that standard. Frankfurt Kurnit notes that removing identifying details from millions of messages is much harder than removing names from structured fields.

California: employees are covered

The CCPA originally carved out personal information collected about job applicants, employees, owners, directors, officers, and contractors. Under Civil Code § 1798.145, that carve-out “shall become inoperative on January 1, 2023.” Since then, a California employee is a “consumer” like anyone else: the law defines a consumer as any natural person who is a California resident.

That brings employees’ data under the CCPA’s sale rules. Under § 1798.120, a consumer may direct a business that sells or shares their personal information not to do so, and a business that sells must give notice that consumers have the “right to opt out.” Frankfurt Kurnit adds that selling personal information also triggers risk assessment obligations under the CCPA regulations.

Other US states mostly exclude employee data

Most other state privacy laws protect people as consumers, not as workers. Three examples, checked against the statute text:

Virginia: a “consumer” under the Consumer Data Protection Act “does not include a natural person acting in a commercial or employment context.”
Colorado: the Colorado Privacy Act (SB 21-190) excludes an individual “acting in a commercial or employment context, as a job applicant, or as a beneficiary of someone acting in an employment context.”
Connecticut: the Connecticut Data Privacy Act excludes an individual “acting in a commercial or employment context or as an employee, owner, director, officer or contractor.”

These laws still matter for customer data. Virginia, for example, gives consumers the right to opt out of the sale of personal data. If you’re in another state, check its statute directly; the definitions vary.

Europe: the GDPR and employee consent

Under the GDPR, employee messages are personal data. Reusing them for a purpose other than the one they were collected for requires a compatibility assessment under Article 6(4), unless it rests on consent or a qualifying law.

Consent is rarely a good answer at work. The EDPB’s Guidelines 05/2020 on consent say an imbalance of power exists in the employment context and that for most processing at work, “the lawful basis cannot and should not be the consent of the employees” because it is unlikely to be freely given. Member states may also set more specific rules for employee data under Article 88.

Truly anonymous data falls outside the GDPR. Recital 26 says the regulation does not apply to anonymous information, but pseudonymized data that could be attributed to a person with additional information is still personal data, judged by “all the means reasonably likely to be used” to identify someone.

US federal rules: stored communications, labor law, and the FTC

Stored Communications Act (part of the ECPA). 18 U.S.C. § 2701 makes unauthorized access to stored electronic communications an offense, but excepts conduct authorized by the entity providing the service. § 2702 bars providers of service “to the public” from knowingly divulging stored contents. How these apply depends on how your systems are hosted and who counts as the provider, a question for counsel.
National Labor Relations Act, Section 7. Messages about pay, scheduling, and working conditions may be protected concerted activity, and Frankfurt Kurnit warns that selling them, especially in a form that could identify or profile employees, could draw NLRA scrutiny. The NLRB says employees may discuss wages in written messages, and have these rights “whether or not you are represented by a union.” Union contracts may also restrict a sale.
FTC. In February 2024 the FTC warned that it may be unfair or deceptive for a company to start sharing data with third parties or using it for AI training and disclose that only through a “surreptitious, retroactive amendment” to its terms or privacy policy.
Platform terms. Slack’s API terms say an app provider may not “use API Data to train a large language model,” so how data is extracted matters too.

Rules by jurisdiction at a glance

Jurisdiction	Covers employee data?	What it means for a sale
California (CCPA/CPRA)	Yes, since January 1, 2023	Transfer for value is a sale unless de-identified; notice and opt-out apply
Virginia (VCDPA)	No, employment context excluded	Customers may opt out of sale of personal data
Colorado (CPA)	No, employment context and job applicants excluded	Consumer rules apply to customer data
Connecticut (CTDPA)	No, employment context excluded	Consumer rules apply to customer data
EU (GDPR)	Yes	Needs a lawful, compatible basis; employee consent rarely valid; anonymous data excluded
US federal	Through specific laws	SCA, NLRA Section 7, and FTC deception rules can still apply

If you’re an employee: what you can do

Read what you were told. Your handbook, acceptable-use policy, and privacy notice set the promises your employer made when it collected your data.
In California: direct your employer not to sell or share your personal information under § 1798.120.
In the EU: object to processing based on legitimate interests under GDPR Article 21, and complain to a supervisory authority in the country where you live or work under Article 77.
If pay or working conditions are involved: raise it with your union or contact the NLRB.
Get advice. An employment or privacy lawyer can tell you which of these applies to you.

If you’re an owner: what a responsible seller excludes

Frankfurt Kurnit’s guidance is to exclude high-risk data entirely rather than rely on de-identification. Its list:

Privileged legal communications
HR and personnel files
Payroll and tax records
Health and benefits information
Union-related communications
Customer and partner confidential information, and licensed data
Data from regulated systems

Beyond exclusions, honor the privacy notices in effect when the data was collected, make sure the agreement names who de-identifies the rest (usually the buyer’s team or a third party it brings in) and to what standard, and put use limits in the data licensing agreement. For the full process, see how to sell data to AI companies; for firms with heavy client confidentiality, see law firm data licensing. If you’re closing, closing business data covers the extra steps.

Questions people ask

Can my employer sell my data?

Sometimes, but not freely. In California, employee personal information has been fully covered by the CCPA since January 1, 2023, so a transfer for money is a “sale” unless the data meets the law’s de-identification standard. In the EU, the GDPR applies to employee messages. Your employer is also bound by the privacy notices and handbooks it gave you.

Can my employer sell my emails and Slack messages for AI training?

Owning the systems doesn’t settle it. Privacy law, the notices you were given, NDAs with customers, platform terms such as Slack’s ban on API data being used to train large language models, and labor law can all limit it. Frankfurt Kurnit advises sellers to exclude HR, payroll, health, and union-related material entirely.

Can companies legally sell your data?

Yes, within limits that depend on where you live. Under the CCPA, a business that sells personal information must let California residents opt out. Virginia gives consumers a right to opt out of the sale of personal data. In the EU, a new use of personal data needs a lawful basis. The FTC has warned against quietly changing terms to permit new uses.

Is it legal to sell customer data?

It can be, if the company’s privacy notice allows it and the applicable law’s requirements are met, such as notice and an opt-out under the CCPA and Virginia’s law. Changing a privacy policy retroactively to allow a sale or AI training may be unfair or deceptive, according to the FTC. Customer data held under contract, such as a client’s confidential files, may not be the company’s to sell at all.

Do Virginia, Colorado, or Connecticut privacy laws protect employee data?

Mostly not. Each defines “consumer” to exclude people acting in an employment context, so employee data falls outside their consumer rights. California, which covers employees, is the exception among these. Other laws, such as labor law and contracts, still apply.

What can I do if my employer sells my data?

Ask what was shared and on what basis. In California you can opt out of the sale of your personal information. In the EU you can object to processing based on legitimate interests and complain to a data protection authority. If messages about pay or working conditions are involved, the National Labor Relations Act may apply. A lawyer can tell you which route fits.

Sources

This guide is general information, not legal, tax, or financial advice. Review any proposed agreement with your own advisers.

Related guides

Check whether your company is a fit. Start with a description of your records; no files needed.