The short answer: Usually, yes, when three things are true: your company owns the records, your contracts and privacy promises allow de-identified use, and personal information can be removed without destroying the useful part. Most deals that fail, fail on the first check. This guide covers the questions your counsel will ask.
Licensing is an ordinary contract
Licensing your own operating data is a commercial agreement, like licensing software or content. You grant a buyer the right to use an agreed copy for agreed purposes, and you keep ownership.
What makes a data license different is what’s inside the data: information about other people, and promises you’ve made about it. That’s what the three checks are for.
Check 1: do you own it?
- Your own operating records, such as internal email, team chat, tickets, CRM notes, procedures and code your staff wrote, are usually yours.
- Records you hold for clients under a services agreement, like an agency’s client work, a bookkeeper’s client ledgers or a law firm’s matter files, usually belong to the client or are bound by confidentiality.
- Contractor work is yours only if the contract assigned the intellectual property to you.
- Third-party content such as licensed reports, vendor manuals and purchased data isn’t yours to license.
- Open-source code in your repositories keeps its own license terms.
Check 2: what have you promised?
Read your customer contracts, your terms of service and every version of your privacy policy that covered the years you’d license. The clause that matters most is whether you may use data in aggregated or de-identified form. Look for confidentiality clauses and limits on sharing with third parties.
Check your software vendors too, because platforms set their own export rules. Slack, for example, changed its API terms in May 2025 so that apps may not bulk-export message data or use it to train language models. That doesn’t settle every export route, so have counsel read the current terms for each system.
Check 3: can the people come out?
Almost every business record mentions people: customers, staff and suppliers. The usual basis for licensing is that identifiers are removed before anyone outside your company sees the data. Names, emails, phone numbers, account numbers and addresses are replaced with consistent placeholders, rare details are generalized, and people review a sample.
Data whose value is who the people are, like customer lists, contact databases and HR files, can’t be licensed this way and should stay out.
US privacy law in plain terms
- State privacy laws. Under the California Consumer Privacy Act and similar laws in other states, making personal information available to another business for something of value can count as a “sale”, whatever the contract calls it. Properly de-identified data, with a contractual ban on re-identification, is treated differently. Counsel should confirm which applies to you.
- Health data. HIPAA sets specific de-identification methods. Identifiable health records stay out.
- Financial data. The Gramm-Leach-Bliley Act limits how financial institutions share customer information.
- Card data. Card numbers and security codes are never included.
- Call recordings. About a dozen states require every party’s consent to record, and some treat voiceprints as biometric data. De-identified transcripts are usually the safer product.
Your employees
Staff names and messages are personal information too. Direct messages and private channels are usually excluded. Whether you must notify employees depends on your policies and state law, but telling your team before records leave the building is good practice even when it isn’t required.
If the company is closing or in bankruptcy
A company that’s winding down can still license its records, often as a one-time archive. In bankruptcy, a court or trustee usually has to approve the sale, and the promises in your privacy policy still apply.
In the Spirit Airlines case, the court notice excluded passenger profiles and loyalty records, and a flight attendants’ union objected to how the remaining data would be handled. Expect that level of scrutiny.
Terms that protect you in the license
- A ban on re-identifying anyone, including by combining your data with other data
- Permitted uses spelled out: training, evaluation, or both
- Whether models trained on your data may serve your direct competitors
- Destruction of raw files after acceptance, with written confirmation
- How deletion requests from your customers reach the buyer
- Confidentiality, so the buyer can’t name you
Common questions
Do we need customer consent to license de-identified records?
Often not, if your terms allow de-identified use and the data is properly de-identified. It depends on your contracts, policies and state law, so counsel decides for each dataset.
Is de-identified data still personal information?
Under most US privacy laws, data that is properly de-identified, with public commitments and contracts against re-identification, is not treated as personal information. Removing names alone is not enough.
Can we license data our clients gave us?
Usually not on your own say. Client-held records belong to the client or are bound by confidentiality. They can be excluded, or licensed with the client’s written agreement.
Who has to approve on our side?
Someone with authority to sign commercial contracts, usually the owner or CEO, and sometimes the board. In a wind-down or bankruptcy, a trustee or the court may need to approve.
Sources
- Bloomberg Law, “Google Aims to Boost AI With Purchase of Spirit Airlines Data”, Aug 2026
- Computerworld, “Salesforce changes Slack API terms to block bulk data access for LLMs”, Jun 11, 2025
- California Consumer Privacy Act, Cal. Civ. Code § 1798.140 (definitions of “sell” and “deidentified”)
- US Department of Health and Human Services, guidance on HIPAA de-identification methods
Want to know where your company stands? The free valuation takes about ten minutes and needs no files.
Talkbase is not a law firm. This guide summarizes public information so you can frame questions for your counsel. It is not legal, tax or financial advice.