Insights · 7 min read

Data Ownership and Rights Before You Sell Data to AI Companies

Having the files is not the same as having the right to license them. Buyers will ask which one you have.

Bearish AI · October 21, 2026

A company can hold ten years of code, chat and tickets and still not be free to sell them. Rights are the question buyers ask first, and unclear rights can take a data set from valuable to unusable. This article is general information, not legal advice. Ownership depends on contracts and local law, so take it to a lawyer who works on data licensing before you commit to anything.

Who might have a claim on your data

What buyers ask you to promise

An attorney who writes about AI data licensing lists the minimum assurances a buyer typically expects: that the licensor owns or can grant the rights, that training use does not infringe third-party rights, and that the data was collected lawfully, including under privacy law, access controls and source-contract terms. Buyers may also ask for a provenance file describing where the data came from, when and how it was collected, how it was processed and which risky subsets were removed. Opt-outs are harder, and licensors often offer only that, to their knowledge, none has been invoked.

If you cannot give those assurances, the data may sit unsold, or be sold for much less with you carrying the risk. That is why the free estimate at /estimate asks how clear your rights are, and lowers the figure when you are unsure.

License, not sale: what you are really granting

Most deals in this area are licenses, not transfers of ownership. The same attorney describes typical buyer drafts as allowing the buyer to train, fine-tune and evaluate models, usually for one named model, with successor models available for an additional fee. A common pairing is a perpetual, worldwide license to train on the data and use the resulting models, plus a finite license to keep accessing the dataset itself. Read that again: even a time-limited deal can leave the buyer with a model that keeps what it learned. Rights language, field of use and exclusivity are therefore central terms, and each changes the price. A lawyer should read them before you sign.

What the cost of getting this wrong looks like

Rights disputes in this market are not hypothetical. A class action over books taken from pirate libraries and used to train models ended in a $1.5 billion settlement, at about $3,000 per work, with final approval in July 2026. The U.S. Copyright Office, in its report on generative AI training, said the knowing use of pirated or illegally accessed works should weigh against fair use, without being determinative.

Those cases are about books, not company archives. The point for owners is the direction of travel. Buyers have seen what unclear provenance can cost, and they price accordingly.

Why scraped data carries this burden and yours can avoid it

A large audit of web sources found that restrictions on AI use are growing. In the common training corpus it studied, about 5 percent of all tokens, and 28 percent or more of the most actively maintained, important sources, were fully restricted. The authors also found inconsistencies between sites’ terms of service and their crawling instructions. Scraped data lives in that uncertainty. Your own records can be different, if you can show that you created them and can license them. See /insights/scraped-data-vs-proprietary-data-value.

Open-source code shows how licenses stay attached. The curated code dataset known as The Stack v2 contains only files under permissive licenses or with no license, and its card states that users must follow the original licenses, including attribution.

People are not just data

Press coverage of the market quotes a law professor saying employers should get express consent before selling workers’ data, and noting that no federal law bans such sales. A lawyer is quoted describing this data as legally risky without vetting, in a market only starting to move toward proper licensing agreements. Whatever the law says where you are, expect employees, customers and unions to care. In one high-profile bankruptcy data sale, the flight attendants’ union objected on privacy grounds.

When rights are unclear but fixable

Unclear is not the same as missing. Many gaps can be narrowed: you can exclude a customer’s tickets, drop a contractor’s modules, or update notices and agreements for future data. You can also document what you do know, such as who wrote what and under which terms. The worst position is not having weaker rights. It is not knowing which rights you have, because a buyer prices uncertainty at the worst case. A lawyer can tell you which gaps are worth closing and which parts are simply best left out.

A practical rights check

• Map sources. List every system holding work data and who administers it.
• Read your contracts. Look for confidentiality, data-use and ownership clauses in customer, partner and contractor agreements.
• Check privacy notices. See what employees and customers were told about use of their data.
• Check code licenses. Separate your own code from third-party and open-source code.
• Decide what to exclude. Drop anything you cannot clear, rather than hoping nobody asks.
• Write it down. A short provenance note makes the later conversation faster.

Rights review sits alongside, and does not replace, privacy work such as /insights/personal-data-lowers-data-value. Both are needed before data leaves your hands.