{
  "dataset": "Rights checklist for selling data for AI training",
  "description": "The questions a buyer's counsel asks before licensing data: good answers, red flags, the kinds of data each applies to and, on our reading (not legal advice), whether it blocks a sale, with sources.",
  "reviewed": "2026-10-11",
  "license": {
    "name": "CC BY 4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/",
    "covers": "our compilation of the tables",
    "excludes": "quotes keep their sources' terms, and article text is not covered"
  },
  "rows": [
    {
      "id": "authority-to-sell",
      "question": "Does the company selling the data own it, and has someone with authority approved the sale?",
      "why": "A buyer's first warranty request is that the licensor owns or controls the rights granted, and a sale signed by the wrong person is void or challengeable.",
      "good": "The legal entity that collected the data is the licensor; the board has approved the licence in writing; if the data is all or substantially all of the company's assets, shareholders have approved too.",
      "redFlag": "A founder selling personally after a shutdown, a former employee holding an export, or no board resolution.",
      "appliesTo": [
        "company-records",
        "source-code",
        "video",
        "audio-speech",
        "images",
        "text-archives",
        "datasets-environments",
        "physical-world",
        "expert-work"
      ],
      "severity": "blocker",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "Terms.Law: AI training data licensing, a usable agreement (Sergei Tokmakov)",
          "url": "https://terms.law/insights/ai-training-data-licensing-usable-agreement.html",
          "date": "undated, read 2026-10-11",
          "quote": "That the licensor owns or has the rights to license the data."
        },
        {
          "title": "Delaware General Corporation Law section 271",
          "url": "https://delcode.delaware.gov/title8/c001/sc10/index.html",
          "date": "read 2026-10-11",
          "quote": "Every corporation may at any meeting of its board of directors or governing body sell, lease or exchange all or substantially all of its property and assets ... when and as authorized by a resolution adopted by the holders of a majority of the outstanding stock of the corporation entitled to vote thereon"
        }
      ]
    },
    {
      "id": "export-route",
      "question": "How did the data leave each software system: a built-in export run by your own admin, or an app or script using the vendor's API?",
      "why": "Several vendors now forbid using API-obtained data for AI training or bulk export, so data pulled the wrong way can be tainted even if the company owns it.",
      "good": "Each system was exported by its own admin with the vendor's native export tool, the method is recorded per system, and no third-party connector touched it.",
      "redFlag": "Data pulled through a connector or scraper from Slack, Zendesk, Xero, Zoom, HubSpot or Google Workspace APIs; Slack DMs exported without the Primary Owner's approved application.",
      "appliesTo": [
        "company-records",
        "text-archives",
        "audio-speech",
        "video",
        "datasets-environments"
      ],
      "severity": "blocker",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "Slack API Terms of Service",
          "url": "https://slack.com/terms-of-service/api",
          "date": "effective 2025-10-10",
          "quote": "(A) use API Data to train a large language model;"
        },
        {
          "title": "Zendesk Developer Terms",
          "url": "https://www.zendesk.nl/company/agreements-and-terms/zendesk-developer-terms/",
          "date": "effective 2025-08-12",
          "quote": "including creating, training, or improving any general AI model, such as, but not limited to, a large language model"
        },
        {
          "title": "Xero Developer Platform Terms and Conditions",
          "url": "https://developer.xero.com/xero-developer-platform-terms-conditions",
          "date": "last updated 2025-12-04",
          "quote": "API Data cannot be used to train, fine tune, adapt, or enhance any AI Models."
        }
      ]
    },
    {
      "id": "customer-contracts-dpa",
      "question": "Does any of the data belong to or describe your customers, and do your customer contracts and data processing agreements allow using it for anything other than serving them?",
      "why": "Where you hold customer data as their processor you may use it only on their instructions, and a processor that decides its own purposes becomes a controller in breach.",
      "good": "Customer content (support tickets, customer files, CRM notes, customer email) is excluded, or each customer contract expressly permits this use, or the data is anonymised to the standard in the anonymisation item and the contract does not forbid that.",
      "redFlag": "Support tickets, customer success call recordings or customer-uploaded files in the dataset; contracts that restrict use to providing the service.",
      "appliesTo": [
        "company-records",
        "text-archives",
        "audio-speech",
        "video",
        "datasets-environments",
        "expert-work"
      ],
      "severity": "blocker",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "GDPR Article 28(3)(a) and 28(10)",
          "url": "https://gdpr-info.eu/art-28-gdpr/",
          "date": "read 2026-10-11",
          "quote": "if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing."
        },
        {
          "title": "Frankfurt Kurnit (Daniel M. Goldberg), Selling Company Data For AI Training: What To Know Before You Say Yes, Legal 500",
          "url": "https://www.legal500.com/intelligence/united-states/privacy/selling-company-data-for-ai-training-what-to-know-before-you-say-yes",
          "date": "2026-10-06",
          "quote": "Review customer, partner, vendor, and data license agreements, identify data held as a service provider or processor, and review platform terms for the systems the data will be extracted from."
        },
        {
          "title": "Venable: Contracting for AI Model Training",
          "url": "https://www.venable.com/insights/publications/2026/06/contracting-for-ai-model-training-key",
          "date": "2026-06-05",
          "quote": "training data can be \"deidentified\" and still contain confidential or valuable information."
        }
      ]
    },
    {
      "id": "counterparty-confidentiality",
      "question": "Does the data contain other companies' confidential information, such as partner documents, pricing, roadmaps or anything shared under an NDA?",
      "why": "NDAs usually limit use to a stated purpose and survive termination, so passing counterparties' material to an AI lab invites breach of contract and trade secret claims.",
      "good": "Shared channels, external email threads, partner folders and attachments from third parties are excluded or reviewed, and you can list which counterparties appear.",
      "redFlag": "Slack Connect channels, vendor negotiation threads, M&A data rooms, or client deliverables in the archive.",
      "appliesTo": [
        "company-records",
        "text-archives",
        "expert-work",
        "datasets-environments"
      ],
      "severity": "blocker",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "Frankfurt Kurnit (Goldberg), Legal 500",
          "url": "https://www.legal500.com/intelligence/united-states/privacy/selling-company-data-for-ai-training-what-to-know-before-you-say-yes",
          "date": "2026-10-06",
          "quote": "Consider privileged material, HR and personnel files, payroll and tax records, health and benefits information, union-related communications, customer and partner confidential information, licensed data, and data from regulated systems."
        }
      ]
    },
    {
      "id": "licensed-third-party-data",
      "question": "Is any of it data or content you licensed from someone else, such as purchased contact lists, research reports, stock media, fonts or design kits?",
      "why": "Licences for bought data and media usually forbid resale or sublicensing, so it usually cannot be passed on to a lab without the licensor's consent.",
      "good": "Bought and licensed material is identified and removed before packaging, and the provenance file shows what remains is the company's own.",
      "redFlag": "CRM records enriched from a list vendor, stock images inside design files, paywalled reports in a shared drive.",
      "appliesTo": [
        "company-records",
        "images",
        "video",
        "text-archives",
        "datasets-environments"
      ],
      "severity": "fixable",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "Frankfurt Kurnit (Goldberg), Legal 500",
          "url": "https://www.legal500.com/intelligence/united-states/privacy/selling-company-data-for-ai-training-what-to-know-before-you-say-yes",
          "date": "2026-10-06",
          "quote": "Review customer, partner, vendor, and data license agreements, identify data held as a service provider or processor, and review platform terms for the systems the data will be extracted from."
        },
        {
          "title": "Terms.Law: AI training data licensing",
          "url": "https://terms.law/insights/ai-training-data-licensing-usable-agreement.html",
          "date": "undated, read 2026-10-11",
          "quote": "The licensor agrees to deliver, at the time of license, a structured record of the data's origin"
        }
      ]
    },
    {
      "id": "employees-california-ccpa",
      "question": "Does the data include personal information of employees, contractors or job applicants in California, and have they been told about the sale and given a way to opt out?",
      "why": "The CCPA exemption for employee data ended on 1 January 2023, so licensing staff data for money is a CCPA sale with notice and opt-out duties.",
      "good": "Either employee personal information is removed to the CCPA deidentified standard, or current and former staff received notice and an opt-out before the sale.",
      "redFlag": "Slack, email or HR records with staff names and messages sold as is; no notice to former employees.",
      "appliesTo": [
        "company-records",
        "text-archives",
        "audio-speech",
        "video",
        "source-code"
      ],
      "severity": "blocker",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "California Consumer Privacy Act (CPPA statute text, effective 01/01/2025), section 1798.145(m)",
          "url": "https://cppa.ca.gov/regulations/pdf/ccpa_statute.pdf",
          "date": "posted January 2025",
          "quote": "(4) This subdivision shall become inoperative on January 1, 2023."
        },
        {
          "title": "California Consumer Privacy Act, section 1798.140 (definition of sell)",
          "url": "https://cppa.ca.gov/regulations/pdf/ccpa_statute.pdf",
          "date": "posted January 2025",
          "quote": "\"Sell,\" \"selling,\" \"sale,\" or \"sold,\" means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating ... a consumer's personal information by the business to a third party for monetary or other valuable consideration."
        }
      ]
    },
    {
      "id": "employees-union-nlra",
      "question": "Do the records include staff discussing pay, working conditions or union matters, or is any workforce covered by a collective bargaining agreement?",
      "why": "US employees have a protected right to act together on working conditions, union-related communications are a category counsel advise excluding, and a bargaining agreement may itself restrict a sale.",
      "good": "Union and HR channels and any discussion of pay or conditions are excluded; if a bargaining agreement exists, it has been checked for data and monitoring clauses.",
      "redFlag": "Employee organising chats, #random channels full of workplace complaints, or a unionised workforce with no review.",
      "appliesTo": [
        "company-records",
        "text-archives",
        "audio-speech",
        "video"
      ],
      "severity": "fixable",
      "inference": "No source found applying Section 7 directly to the sale of employee communications; the link is an inference from the protected-activity right and counsel's exclusion advice.",
      "status": null,
      "sources": [
        {
          "title": "National Labor Relations Act section 7, 29 U.S.C. 157",
          "url": "https://www.law.cornell.edu/uscode/text/29/157",
          "date": "read 2026-10-11",
          "quote": "Employees shall have the right to self-organization, to form, join, or assist labor organizations"
        },
        {
          "title": "Frankfurt Kurnit (Goldberg), Legal 500",
          "url": "https://www.legal500.com/intelligence/united-states/privacy/selling-company-data-for-ai-training-what-to-know-before-you-say-yes",
          "date": "2026-10-06",
          "quote": "Where employees are unionized, the collective bargaining agreement may restrict the sale, and the company may have bargaining obligations."
        }
      ]
    },
    {
      "id": "employees-eu-lawful-basis",
      "question": "For staff in the EU or UK, what legal basis lets you reuse the personal data in their work (messages, documents, code history, recordings) for a sale, and is that new purpose compatible with why you collected it?",
      "why": "Employee consent is rarely valid because of the power imbalance, and a new purpose must pass the GDPR compatibility test or have its own basis.",
      "good": "The data is anonymised to the EU standard before it leaves (only truly anonymous data is outside GDPR; de-identified or pseudonymised data stays personal data), with a documented legitimate-interests and compatibility assessment covering the anonymisation step itself, and notice to staff.",
      "redFlag": "Relying on a consent tick-box from employees, or treating name-replaced (pseudonymised) chat logs as outside GDPR.",
      "appliesTo": [
        "company-records",
        "text-archives",
        "audio-speech",
        "video",
        "source-code",
        "images"
      ],
      "severity": "blocker",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "EDPB Guidelines 05/2020 on consent, section 3.1.1",
          "url": "https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en",
          "date": "2020-05-04 (older, still current)",
          "quote": "Given the dependency that results from the employer/employee relationship, it is unlikely that the data subject is able to deny his/her employer consent to data processing without experiencing the fear or real risk of detrimental effects as a result of a refusal."
        },
        {
          "title": "GDPR Article 6(4)",
          "url": "https://gdpr-info.eu/art-6-gdpr/",
          "date": "read 2026-10-11",
          "quote": "the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia: any link between the purposes ... the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller"
        }
      ]
    },
    {
      "id": "works-council",
      "question": "If you have a works council in the Netherlands or Germany, has it been consulted about processing staff data for this sale, and has it agreed where required?",
      "why": "Dutch law requires works council consent for any arrangement on processing employees' personal data, and German works councils co-determine technical systems that can monitor staff behaviour or performance.",
      "good": "The works council approved the processing arrangement (the Netherlands) or a works agreement covers the export and anonymisation tooling (Germany), recorded in minutes.",
      "redFlag": "A Dutch or German entity with a works council and no consultation; decisions taken without consent can be void in the Netherlands if the council invokes it.",
      "appliesTo": [
        "company-records",
        "text-archives",
        "audio-speech",
        "video",
        "source-code"
      ],
      "severity": "fixable",
      "inference": "Whether a one-off export and sale is an 'arrangement' (regeling) under WOR 27(1)(k) or a monitoring system under BetrVG 87(1)6 is not settled in the sources read; the 'void' consequence refers to WOR article 27(5), not re-read. A question for a lawyer.",
      "status": null,
      "sources": [
        {
          "title": "Wet op de ondernemingsraden (Dutch Works Councils Act) article 27(1)(k)",
          "url": "https://wetten.overheid.nl/BWBR0002747/",
          "date": "read 2026-10-11",
          "quote": "De ondernemer behoeft de instemming van de ondernemingsraad voor elk door hem voorgenomen besluit tot vaststelling, wijziging of intrekking van: ... k. een regeling omtrent het verwerken van alsmede de bescherming van de persoonsgegevens van de in de onderneming werkzame personen"
        },
        {
          "title": "Betriebsverfassungsgesetz (German Works Constitution Act) section 87(1) no. 6",
          "url": "https://www.gesetze-im-internet.de/betrvg/__87.html",
          "date": "read 2026-10-11",
          "quote": "Der Betriebsrat hat, soweit eine gesetzliche oder tarifliche Regelung nicht besteht, in folgenden Angelegenheiten mitzubestimmen: ... 6. Einführung und Anwendung von technischen Einrichtungen, die dazu bestimmt sind, das Verhalten oder die Leistung der Arbeitnehmer zu überwachen;"
        }
      ]
    },
    {
      "id": "canada-consent-or-anonymisation",
      "question": "For customers or staff in Canada, has each person consented to this new use, or will the data be anonymised to the Canadian standard before it leaves? For Quebec, is the privacy impact assessment done and the written agreement ready?",
      "why": "Canada's federal privacy law has no legitimate interest ground: a new use or disclosure needs the person's consent, and only data with no serious possibility of re-identification is outside it. Quebec adds an impact assessment and a written agreement before personal information leaves the province.",
      "good": "The data is anonymised to the regulator's standard (no serious possibility of re-identification, alone or with other available information) with the test written down, or each person consented to this licence; for Quebec, the impact assessment is done and the agreement with the buyer reflects it.",
      "redFlag": "Names, phone numbers and emails stripped while the free text still points to people (the regulator found that alone insufficient in 2026), or relying on the business transaction exception, which excludes a deal whose purpose is selling personal information.",
      "appliesTo": [
        "company-records",
        "text-archives",
        "audio-speech",
        "video",
        "images",
        "datasets-environments",
        "physical-world"
      ],
      "severity": "blocker",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "PIPEDA Schedule 1, clause 4.2.4: a purpose not previously identified needs the individual's consent",
          "url": "https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html",
          "date": "read 2026-10-18",
          "quote": "When personal information that has been collected is to be used for a purpose not previously identified, the new purpose shall be identified prior to use. Unless the new purpose is required by law, the consent of the individual is required before information can be used for that purpose."
        },
        {
          "title": "OPC, PIPEDA Findings #2026-001 (Loblaw, PC Optimum): the standard for anonymized information",
          "url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-001/",
          "date": "read 2026-10-18",
          "quote": "The term \"made anonymous\" is not defined in PIPEDA. ... We therefore find that for information to be considered anonymized for the purpose of Principle 4.5.3, the organization must take steps to ensure that there is no serious possibility that the information retained may be reidentified, either alone or in combination with other available information. ... Based on the data points that Loblaw described, we find that stripping accounts of names, phone numbers and email addresses alone is insufficient for Loblaw to demonstrate that the data it retains is anonymized."
        },
        {
          "title": "Quebec private sector Act, section 17: privacy impact assessment before communicating information outside Quebec",
          "url": "https://www.publicationsduquebec.gouv.qc.ca/fileadmin/gazette/pdf_encrypte/gaz_entiere/2202-A.pdf",
          "date": "read 2026-10-18",
          "quote": "Before communicating personal information outside Québec, a person carrying on an enterprise must conduct a privacy impact assessment. ... The information may be communicated if the assessment establishes that it would receive adequate protection, in particular in light of generally recognized principles regarding the protection of personal information. The communication of the information must be the subject of a written agreement that takes into account, in particular, the results of the assessment and, if applicable, the terms agreed on to mitigate the risks identified in the assessment."
        }
      ]
    },
    {
      "id": "anonymisation-eu-standard",
      "question": "Has personal data been removed to the EU anonymisation standard, and who tested it?",
      "why": "Under the EDPB's draft 2026 guidelines data is anonymous only if no one can be singled out, linked or inferred, and the anonymisation process itself needs a legal basis; pseudonymised data stays personal data.",
      "good": "An independent de-identification provider ran a documented test against the three criteria, certified the result before transfer, and the buyer commits not to re-identify and flows that down (the Spirit Airlines ombudsman model).",
      "redFlag": "Names swapped for tokens in workplace chat, small teams where writing style or role identifies people, no written test, or you keep the key.",
      "appliesTo": [
        "company-records",
        "text-archives",
        "audio-speech",
        "video",
        "images",
        "datasets-environments",
        "physical-world"
      ],
      "severity": "blocker",
      "inference": null,
      "status": "Guidelines 02/2026 are a draft under consultation until 30 October 2026, not final.",
      "sources": [
        {
          "title": "DLA Piper Privacy Matters: EU EDPB publishes draft guidelines on anonymisation",
          "url": "https://privacymatters.dlapiper.com/2026/08/eu-edpb-publishes-draft-guidelines-on-anonymisation/",
          "date": "2026-08-13",
          "quote": "the process of anonymisation itself remains subject to the GDPR and must comply with applicable legal bases, transparency obligations and accountability requirements."
        },
        {
          "title": "EDPB public consultation: Guidelines 02/2026 on Anonymisation",
          "url": "https://www.edpb.europa.eu/public-consultations/guidelines-022026-on-anonymisation_en",
          "date": "consultation 2026-07-08 to 2026-10-30",
          "quote": "Such comments should be sent on 30 October 2026 at the latest using the provided form."
        },
        {
          "title": "The Next Web: Google and Spirit Airlines data, ombudsman report",
          "url": "https://thenextweb.com/news/google-spirit-airlines-data-ombudsman-approval",
          "date": "2026-10-09",
          "quote": "Spirit has hired Tonic.ai to deidentify that unstructured data, according to the report. The agent must file a certification with the court before every transfer. ... The buyer must publicly commit not to try to reidentify the data. It also may not pass it on unless the recipient makes the same commitment. ... The potential privacy losses or costs to consumers have been eliminated or mitigated."
        }
      ]
    },
    {
      "id": "deidentification-ccpa",
      "question": "For US consumer or staff data, does the de-identification meet the CCPA definition, including a public commitment and contract terms binding the buyer?",
      "why": "CCPA 'deidentified' data needs three things from the business holding it: reasonable technical measures, a public no-re-identification commitment, and contracts making recipients comply.",
      "good": "Reasonable measures documented, a published commitment not to re-identify, and the licence obliges the buyer (and anyone it passes data to) to do the same.",
      "redFlag": "A 'PII removed' claim with no public commitment and no contractual flow-down.",
      "appliesTo": [
        "company-records",
        "text-archives",
        "audio-speech",
        "video",
        "images",
        "datasets-environments",
        "physical-world"
      ],
      "severity": "fixable",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "California Civil Code 1798.140(m), CPPA statute text",
          "url": "https://cppa.ca.gov/regulations/pdf/ccpa_statute.pdf",
          "date": "posted January 2025",
          "quote": "\"Deidentified\" means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information: (1) Takes reasonable measures to ensure that the information cannot be associated with a consumer or household. (2) Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information ... (3) Contractually obligates any recipients of the information to comply with all provisions of this subdivision."
        }
      ]
    },
    {
      "id": "health-data-hipaa",
      "question": "Does any data come from health care, health insurance, or work you did for a health client under a business associate agreement?",
      "why": "Protected health information can be sold only if de-identified by HIPAA safe harbor (18 identifier types removed, no actual knowledge) or expert determination (very small risk), and a business associate agreement may forbid it entirely.",
      "good": "Expert determination by a qualified statistician with written methods, or safe harbor with all 18 identifiers removed, plus confirmation the BAA permits de-identified use; data use agreement banning re-identification.",
      "redFlag": "Clinical notes or patient support chats with free text; data held as a business associate; voice or face recordings of patients (biometric identifiers are on the safe harbor list).",
      "appliesTo": [
        "company-records",
        "text-archives",
        "audio-speech",
        "video",
        "images",
        "datasets-environments",
        "expert-work"
      ],
      "severity": "blocker",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "45 CFR 164.514(a)-(b)",
          "url": "https://www.law.cornell.edu/cfr/text/45/164.514",
          "date": "read 2026-10-11",
          "quote": "Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information."
        },
        {
          "title": "45 CFR 164.514(b)(2)(i)(P)-(Q)",
          "url": "https://www.law.cornell.edu/cfr/text/45/164.514",
          "date": "read 2026-10-11",
          "quote": "Biometric identifiers, including finger and voice prints; (Q) Full face photographic images and any comparable images"
        },
        {
          "title": "Foley & Lardner: AI Contracts in Health Care",
          "url": "https://www.foley.com/p/102kpu0/ai-contracts-in-health-care-avoiding-the-data-dumpster-fire/",
          "date": "2025-06-25",
          "quote": "the BAA likely governs as a result of the typical conflict language in the BAA favoring the BAA when PHI is at issue."
        }
      ]
    },
    {
      "id": "biometrics-bipa",
      "question": "Does the data contain voices, faces, fingerprints or other biometrics of people who may be in Illinois, Texas or Washington?",
      "why": "Illinois BIPA forbids anyone holding biometric identifiers (voiceprints, face geometry) from selling or profiting from them, with $1,000 to $5,000 statutory damages per violation, and nine voice-training class actions were filed in May 2026.",
      "good": "Recordings of your own consenting contributors with written releases naming AI training and sale; no biometric templates extracted by you; Illinois residents excluded or separately released; buyer warrants it will not extract identifiers without its own consent basis.",
      "redFlag": "Call-centre recordings, meeting videos, CCTV or customer selfies; any dataset marketed for voice cloning or face recognition.",
      "appliesTo": [
        "audio-speech",
        "video",
        "images",
        "physical-world"
      ],
      "severity": "blocker",
      "inference": "Whether raw audio or video (as opposed to an extracted voiceprint or face template) is a 'biometric identifier' is contested in the pending May 2026 cases; treat voice and face datasets as exposed until courts rule.",
      "status": null,
      "sources": [
        {
          "title": "740 ILCS 14/15(c) (Illinois Biometric Information Privacy Act)",
          "url": "https://www.ilga.gov/Documents/legislation/ilcs/documents/074000140K15.htm",
          "date": "read 2026-10-11 from a search excerpt of the official text",
          "quote": "(c) No private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person's or a customer's biometric identifier or biometric information."
        },
        {
          "title": "740 ILCS 14/10 (definition)",
          "url": "https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57",
          "date": "read 2026-10-11 from a search excerpt",
          "quote": "\"Biometric identifier\" means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry."
        }
      ]
    },
    {
      "id": "recording-consent",
      "question": "Were calls and meetings recorded with every participant's consent, and did that consent cover use beyond the meeting?",
      "why": "California and other all-party-consent states make recording a confidential conversation without everyone's consent a crime, and Zoom's API terms forbid multi-customer AI training on meeting content.",
      "good": "Recording notices on every call, written consent from internal participants for AI licensing, external participants (clients, candidates) excluded or separately consented.",
      "redFlag": "Sales or support call libraries recorded under 'for quality and training purposes' notices only; meetings with external guests.",
      "appliesTo": [
        "audio-speech",
        "video"
      ],
      "severity": "blocker",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "California Penal Code 632(a)",
          "url": "https://california.public.law/codes/penal_code_section_632",
          "date": "read 2026-10-11 from a search excerpt",
          "quote": "intentionally and without the consent of all parties to a confidential communication, uses an electronic amplifying or recording device to eavesdrop upon or record the confidential communication"
        },
        {
          "title": "Zoom API License and Terms of Use",
          "url": "https://explore.zoom.us/en/legal/zoom-api-license-and-tou/",
          "date": "last updated 2025-07-16",
          "quote": "the resulting customized model may only be used by the Customer who consented to the use of their Customer Content and not by any other party."
        }
      ]
    },
    {
      "id": "third-party-copyright",
      "question": "Does the data include text, images, video or files created by others that you do not own (articles, reports, books, customer uploads, screenshots of other products)?",
      "why": "In September 2026 the Third Circuit held that copying Westlaw headnotes to train a competing AI tool was not fair use, so third-party content inside an archive carries real infringement risk for the buyer and the holder's warranty.",
      "good": "Third-party content is identified and removed or licensed; what remains is the company's own original work.",
      "redFlag": "Shared drives full of downloaded PDFs and reports, wiki pages pasted from vendors' docs, image folders scraped from the web.",
      "appliesTo": [
        "text-archives",
        "images",
        "video",
        "company-records",
        "expert-work",
        "datasets-environments"
      ],
      "severity": "blocker",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "LawNext: 3rd Circuit rules for Thomson Reuters against ROSS",
          "url": "https://www.lawnext.com/2026/09/3rd-circuit-rules-for-thomson-reuters-in-its-copyright-fight-against-legal-research-startup-ross.html",
          "date": "2026-09-30",
          "quote": "ruled in favor of Thomson Reuters on the two primary issues that were before it – copyrightability of the Westlaw headnotes and fair use."
        },
        {
          "title": "Terms.Law: AI training data licensing",
          "url": "https://terms.law/insights/ai-training-data-licensing-usable-agreement.html",
          "date": "undated",
          "quote": "That the use of the data for training as specified in the agreement does not infringe a third party's copyright"
        }
      ]
    },
    {
      "id": "open-source-licences",
      "question": "Does the code include third-party open-source code, and do you have a list of each licence?",
      "why": "Open-source licences travel with the code, and the breach-of-licence claims against GitHub Copilot survived and remain pending even after the DMCA claim failed in September 2026.",
      "good": "A software bill of materials or licence scan; vendored and copied third-party code is either removed or delivered with its licence and attribution; only the company's own code is warranted.",
      "redFlag": "Vendored GPL/AGPL code mixed into the repo, copied snippets without attribution, no licence scan.",
      "appliesTo": [
        "source-code",
        "datasets-environments"
      ],
      "severity": "fixable",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "Haynes Boone: Ninth Circuit rejects DMCA 1202(b) theory (Doe v. GitHub)",
          "url": "https://www.haynesboone.com/news/alerts/ai-legal-news-ninth-circuit-rejects-dmca-section-1202(b)-theory",
          "date": "2026-09-18",
          "quote": "The contract claims remain pending."
        }
      ]
    },
    {
      "id": "ip-assignment",
      "question": "Did every employee and contractor who created the code, documents or recordings sign an agreement assigning their work to the company?",
      "why": "A company can only license what it owns, and SaaS terms say the customer owns its content only as between it and the vendor, not against its own contractors.",
      "good": "Signed invention and IP assignment agreements for all contributors, including contractors and agencies; gaps listed and excluded.",
      "redFlag": "Freelancers or agencies without written assignment, open-source contributors' pull requests, founders who never assigned pre-incorporation work.",
      "appliesTo": [
        "source-code",
        "expert-work",
        "images",
        "video",
        "text-archives",
        "datasets-environments"
      ],
      "severity": "fixable",
      "inference": "No source read addresses IP assignment specifically in data sales; the item follows from the ownership warranty buyers request.",
      "status": null,
      "sources": [
        {
          "title": "Zoom Terms of Service (customer representation)",
          "url": "https://www.zoom.com/en/trust/terms/",
          "date": "read 2026-10-11",
          "quote": "You represent and warrant that you are either the author of all Customer Content to be provided under this Agreement or have obtained and hold all rights necessary to provide such Customer Content"
        },
        {
          "title": "Terms.Law: AI training data licensing",
          "url": "https://terms.law/insights/ai-training-data-licensing-usable-agreement.html",
          "date": "undated",
          "quote": "That the licensor owns or has the rights to license the data."
        }
      ]
    },
    {
      "id": "prior-privacy-promises",
      "question": "What did your privacy policy, terms of service and employee handbook say about sharing or selling data at the time it was collected?",
      "why": "The FTC's position is that a company cannot quietly change its terms to allow AI training on data collected under earlier promises, and in bankruptcy a policy against transfer blocks a sale without court approval.",
      "good": "The policies in force when the data was collected allowed this kind of transfer, or affected people gave fresh affirmative consent, or the data is fully anonymised.",
      "redFlag": "'We never sell your data' in an old privacy policy; a policy changed recently to add AI training; no record of past versions.",
      "appliesTo": [
        "company-records",
        "text-archives",
        "audio-speech",
        "video",
        "images",
        "datasets-environments",
        "physical-world"
      ],
      "severity": "blocker",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "FTC Technology Blog: AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive",
          "url": "https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive",
          "date": "2024-02-13 (older, still the FTC's stated position)",
          "quote": "A business that collects user data based on one set of privacy commitments cannot then unilaterally renege ... It may be unfair or deceptive for a company to adopt more permissive data practices ... through a surreptitious, retroactive amendment to its terms of service or privacy policy."
        },
        {
          "title": "11 U.S.C. 363(b)(1)",
          "url": "https://www.law.cornell.edu/uscode/text/11/363",
          "date": "read 2026-10-11",
          "quote": "if the debtor in connection with offering a product or a service discloses to an individual a policy prohibiting the transfer of personally identifiable information about individuals to persons that are not affiliated with the debtor ... then the trustee may not sell or lease personally identifiable information to any person unless– (A) such sale or such lease is consistent with such policy; or (B) after appointment of a consumer privacy ombudsman"
        }
      ]
    },
    {
      "id": "privilege-trade-secrets",
      "question": "Does the data include legal advice, litigation material, or trade secrets (yours or other companies')?",
      "why": "Disclosing privileged communications to a buyer can waive privilege, and counsel list privileged material first among categories to exclude.",
      "good": "Legal channels, outside counsel email and litigation folders are excluded; trade secrets the company wants to keep are excluded or the buyer's use is restricted contractually.",
      "redFlag": "#legal channels, email with outside counsel, board minutes, or a competitor's materials received in a deal.",
      "appliesTo": [
        "company-records",
        "text-archives",
        "source-code",
        "expert-work"
      ],
      "severity": "fixable",
      "inference": "The waiver point is general legal knowledge, not quoted from a source read.",
      "status": null,
      "sources": [
        {
          "title": "Frankfurt Kurnit (Goldberg), Legal 500",
          "url": "https://www.legal500.com/intelligence/united-states/privacy/selling-company-data-for-ai-training-what-to-know-before-you-say-yes",
          "date": "2026-10-06",
          "quote": "Exclude high-risk data entirely rather than relying on de-identification. Consider privileged material, HR and personnel files, payroll and tax records, health and benefits information, union-related communications, customer and partner confidential information, licensed data, and data from regulated systems."
        }
      ]
    },
    {
      "id": "lender-consent",
      "question": "Does any lender hold security over the company's assets or IP, or have a right to approve asset sales or IP dispositions?",
      "why": "Venture and bank loans commonly include a negative pledge on IP and an asset-sale covenant that lenders watch for disposals of material IP.",
      "good": "Loan documents checked; the data licence is a permitted disposition or outbound licence, or the lender consented in writing.",
      "redFlag": "Outstanding venture debt with a disposition covenant, or a lien on all assets including IP, and no consent.",
      "appliesTo": [
        "company-records",
        "source-code",
        "video",
        "audio-speech",
        "images",
        "text-archives",
        "datasets-environments",
        "physical-world",
        "expert-work"
      ],
      "severity": "fixable",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "DLA Piper: Ensuring positive outcomes with negative pledges in venture lending",
          "url": "https://www.dlapiper.com/insights/publications/2024/09/ensuring-positive-outcomes-with-negative-pledges-in-venture-lending",
          "date": "2024-09-17 (older)",
          "quote": "agrees not to grant a security interest in its intellectual property to anyone else (lenders watch the disposition or asset sale covenant for borrowers using it to dispose of material intellectual property)"
        }
      ]
    },
    {
      "id": "board-shareholder-consent",
      "question": "Has the board approved the licence, and do investor agreements or charters give investors a veto over selling or licensing key assets?",
      "why": "A sale of all or substantially all assets needs shareholder approval in Delaware, and preferred-stock protective provisions often require investor consent for asset sales or exclusive licences.",
      "good": "Board resolution plus any required investor consents on file; for a wind-down, the dissolution plan covers the sale.",
      "redFlag": "An exclusive licence of the company's main dataset with no board or investor sign-off.",
      "appliesTo": [
        "company-records",
        "source-code",
        "video",
        "audio-speech",
        "images",
        "text-archives",
        "datasets-environments",
        "physical-world",
        "expert-work"
      ],
      "severity": "fixable",
      "inference": "Investor protective provisions are general practice knowledge, not quoted from a source read.",
      "status": null,
      "sources": [
        {
          "title": "Delaware General Corporation Law section 271",
          "url": "https://delcode.delaware.gov/title8/c001/sc10/index.html",
          "date": "read 2026-10-11",
          "quote": "when and as authorized by a resolution adopted by the holders of a majority of the outstanding stock of the corporation entitled to vote thereon"
        }
      ]
    },
    {
      "id": "insolvency-authority",
      "question": "If the company is closing, insolvent or in bankruptcy, who now has legal authority to sell: the board, an assignee for the benefit of creditors, a bankruptcy trustee, or a Dutch curator?",
      "why": "Once a company is in formal insolvency the founders lose authority: in US bankruptcy a privacy-policy conflict requires a consumer privacy ombudsman and court approval, and a Dutch curator needs the supervisory judge's permission for a private sale.",
      "good": "The right officeholder signs; in US bankruptcy the sale goes through section 363 with an ombudsman where personal data is involved (Spirit Airlines to Google, October 2026); in a Dutch faillissement the curator has rechter-commissaris consent.",
      "redFlag": "A founder selling a bankrupt company's archive directly; a wind-down outside court with a privacy policy that forbids transfer.",
      "appliesTo": [
        "company-records",
        "source-code",
        "video",
        "audio-speech",
        "images",
        "text-archives",
        "datasets-environments",
        "physical-world",
        "expert-work"
      ],
      "severity": "blocker",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "11 U.S.C. 332(a) (consumer privacy ombudsman)",
          "url": "https://www.law.cornell.edu/uscode/text/11/332",
          "date": "read 2026-10-11",
          "quote": "If a hearing is required under section 363(b)(1)(B), the court shall order the United States trustee to appoint, not later than 7 days before the commencement of the hearing, 1 disinterested person (other than the United States trustee) to serve as the consumer privacy ombudsman in the case"
        },
        {
          "title": "Faillissementswet (Dutch Bankruptcy Act) articles 68 and 176",
          "url": "https://wetten.overheid.nl/BWBR0001860/2025-01-01",
          "date": "version 2025-01-01, read 2026-10-11",
          "quote": "De curator is belast met het beheer en de vereffening van de failliete boedel. ... De goederen worden in het openbaar of met toestemming van de rechter-commissaris ondershands verkocht."
        },
        {
          "title": "The Next Web: Spirit Airlines data and the ombudsman",
          "url": "https://thenextweb.com/news/google-spirit-airlines-data-ombudsman-approval",
          "date": "2026-10-09",
          "quote": "Google, at $10m, won the August auction (as summarised by the fetch tool; hearing scheduled 14 October 2026)."
        }
      ]
    },
    {
      "id": "export-controls",
      "question": "Does the data include controlled technical information, such as semiconductor designs, aerospace or defence engineering, or advanced encryption source code?",
      "why": "Releasing controlled technology or source code to a foreign national, even inside the US, is a deemed export under the EAR, and AI labs employ foreign nationals and use offshore compute.",
      "good": "Technical archives screened for export-controlled content (ECCN or USML review) and controlled material excluded.",
      "redFlag": "Chip design repos, defence contractor Jira projects, ITAR-marked documents.",
      "appliesTo": [
        "source-code",
        "company-records",
        "expert-work",
        "datasets-environments",
        "physical-world"
      ],
      "severity": "blocker",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "15 CFR 734.13(b)",
          "url": "https://www.law.cornell.edu/cfr/text/15/734.13",
          "date": "read 2026-10-11",
          "quote": "Any release in the United States of \"technology\" or source code to a foreign person is a deemed export to the foreign person's most recent country of citizenship or permanent residency."
        },
        {
          "title": "GitLab Subscription Agreement, section 12.1",
          "url": "https://handbook.gitlab.com/handbook/legal/subscription-agreement/",
          "date": "read 2026-10-11",
          "quote": "Customer shall not export, reexport, or transfer the Controlled Subject Matter except as authorized by these laws and regulations."
        }
      ]
    },
    {
      "id": "doj-bulk-data-buyer-screening",
      "question": "Is the buyer, or anyone it may pass the data to, a foreign person, and does the dataset contain US sensitive personal data above the bulk thresholds?",
      "why": "The DOJ Data Security Program bans data brokerage of bulk US sensitive personal data to countries of concern and requires a contractual onward-transfer ban and violation reporting for any other foreign buyer.",
      "good": "Buyer screened for ownership by or location in China, Russia, Iran, North Korea, Cuba or Venezuela; data checked against thresholds (for example biometric identifiers over 1,000 US persons, health or financial data over 10,000, covered identifiers over 100,000); onward-transfer clause in the licence for foreign buyers.",
      "redFlag": "A buyer with a Hong Kong or mainland China parent; voice or face data on thousands of US persons going to any foreign lab with no clause.",
      "appliesTo": [
        "company-records",
        "audio-speech",
        "video",
        "images",
        "physical-world",
        "datasets-environments",
        "text-archives"
      ],
      "severity": "blocker",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "28 CFR 202.205 (bulk)",
          "url": "https://www.law.cornell.edu/cfr/text/28/202.205",
          "date": "read 2026-10-11",
          "quote": "(b) Biometric identifiers collected about or maintained on more than 1,000 U.S. persons; ... (d) Personal health data collected about or maintained on more than 10,000 U.S. persons; (e) Personal financial data collected about or maintained on more than 10,000 U.S. persons; (f) Covered personal identifiers collected about or maintained on more than 100,000 U.S. persons"
        },
        {
          "title": "28 CFR 202.302(a)",
          "url": "https://www.law.cornell.edu/cfr/text/28/202.302",
          "date": "read 2026-10-11",
          "quote": "no U.S. person ... may knowingly engage in any transaction that involves any access by a foreign person to government-related data or bulk U.S. sensitive personal data and that involves data brokerage with any foreign person that is not a covered person unless the U.S. person: (1) Contractually requires that the foreign person refrain from engaging in a subsequent covered data transaction involving data brokerage of the same data with a country of concern or covered person; and (2) Reports any known or suspected violations"
        }
      ]
    },
    {
      "id": "vendor-already-trained",
      "question": "Has a software vendor already used this content to train its own AI (for example Atlassian since August 2026, GitHub Copilot interactions, HubSpot, ServiceNow Now Assist, Figma)?",
      "why": "It does not stop a sale, but a buyer paying for exclusivity will want to know whether a platform vendor already holds a model trained on the same material.",
      "good": "You list each vendor's AI-training setting and when it was switched off, and the licence states exclusivity only against third parties you control.",
      "redFlag": "Promising 'never seen by any AI' when the workspace sat on a plan where vendor training defaulted on.",
      "appliesTo": [
        "company-records",
        "source-code",
        "text-archives",
        "images"
      ],
      "severity": "note",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "Atlassian Trust: Data contribution",
          "url": "https://www.atlassian.com/trust/ai/data-contribution",
          "date": "change effective 2026-08-17",
          "quote": "If your Atlassian organization has an active Enterprise plan, you can opt-out of metadata contribution. If your Atlassian organization’s highest active plan is Free, Standard, or Premium, metadata contribution is always on, and you’re not able to opt-out. ... every customer has the option to opt out of contributing in-app data."
        },
        {
          "title": "HubSpot Customer Terms of Service 5.3.1",
          "url": "https://legal.hubspot.com/terms-of-service",
          "date": "last modified 2026-09-16",
          "quote": "We may also use Customer Data to train our AI models in compliance with our obligations under the Agreement."
        }
      ]
    },
    {
      "id": "sample-before-review",
      "question": "Has any sample of the data already been shown to a buyer or broker before this rights review?",
      "why": "A sample is itself a disclosure, so it carries every problem in this checklist before any contract protects you.",
      "good": "No samples shared yet; when they are, they are drawn from the reviewed, de-identified set under an NDA.",
      "redFlag": "Raw Slack or email excerpts already sent to prospective buyers.",
      "appliesTo": [
        "company-records",
        "source-code",
        "video",
        "audio-speech",
        "images",
        "text-archives",
        "datasets-environments",
        "physical-world",
        "expert-work"
      ],
      "severity": "fixable",
      "inference": null,
      "status": null,
      "sources": [
        {
          "title": "Frankfurt Kurnit (Goldberg), Legal 500",
          "url": "https://www.legal500.com/intelligence/united-states/privacy/selling-company-data-for-ai-training-what-to-know-before-you-say-yes",
          "date": "2026-10-06",
          "quote": "Do not share sample data before this review, since a sample itself could be a disclosure."
        }
      ]
    }
  ]
}