How do employee and customer privacy rules affect licensing company data?

Updated October 25, 2026 · How we research

Why is privacy the main issue in most deals?

Email threads, chat logs, CRM entries and support tickets name real people. They include phone numbers, addresses, job details and sometimes much more. Sharing that information with an outside company for money can count as a sale of personal information under some laws.

Under California's CCPA, for example, selling means making personal information available to another business for money or anything else of value. Businesses that sell or share personal information must give people notice and a way to opt out.

Does California's CCPA apply to my company?

The CCPA applies to for-profit businesses that do business in California and meet any one of three tests. As of October 2026, the California Privacy Protection Agency lists them as follows.

If none of these apply, other state laws or industry rules still may. Your lawyer can tell you which laws reach your business.

• Gross annual revenue of $26.625 million or more in the prior calendar year (the adjusted figure effective January 1, 2025)
• Buying, selling or sharing personal information of 100,000 or more California residents or households
• Earning half or more of annual revenue from selling or sharing California residents' personal information

Are employee records covered?

Yes, in California. The CCPA's temporary exemption for employment-related information expired at the end of 2022. Since then, employees and job applicants have the same core rights as other California consumers: to know what is held about them, to delete it, to correct it, to opt out of its sale or sharing, and to limit use of sensitive information.

Many employers also have written policies saying company email is for business use and may be monitored. That can help with monitoring questions, but it does not by itself give permission to license employee messages to a third party. Treat those as separate questions.

What counts as sensitive information?

California treats some personal information as sensitive and gives people extra control over it. The list includes government ID numbers, account logins and financial account numbers with passwords, precise location, racial or ethnic origin, religion, union membership, citizenship or immigration status, health information, sex life or sexual orientation, genetic and biometric data, and the contents of someone's mail, email or texts where the business is not the intended recipient.

Many buyer programs say they exclude or strip this kind of material, but you should not rely on that alone. Decide up front which folders and record types never leave your systems, such as HR files, payroll, benefits and medical notes.

Does de-identification solve the problem?

It helps a great deal, but it has limits. Under the CCPA, information only counts as deidentified if it cannot reasonably be linked to a person and the business holding it takes reasonable steps to keep it that way, publicly commits not to re-identify it, and requires anyone who receives it to follow the same rules.

NIST, the federal standards agency, says de-identification reduces risk but does not remove it, and that re-identification risk should be measured rather than assumed away. Ask each buyer who does the de-identification, what standard they use, and whether you get to review a sample before anything leaves.

What else should you check?

Read what your own privacy notices and customer terms promised. In February 2024 the FTC warned that companies which quietly change their privacy terms to allow uses like AI training, and then apply that change to data they already collected, may be acting unfairly or deceptively.

If you have customers or staff in the European Union, the GDPR may apply to companies outside the EU that offer goods or services to people there or monitor their behavior. Regulated data such as health and financial records carries its own rules. Health records in particular go to our sister site, licensemydata.com.

General information, not legal, tax or financial advice.