How to sell AI training data in Europe
By Nico Vergauwen, founder of grokkedPublished Updated 8 min read
A company in Europe sells AI training data by licensing a de-identified copy of its internal data, such as team chat, email, support tickets, documents and code, to AI labs. The buyer gets a non-exclusive license; the company keeps its originals. Under EU law this works if personal data is anonymized before a buyer sees it, the anonymization has a legal basis under the GDPR, staff and works councils are told where the law requires it, and nothing under professional secrecy or an NDA goes in.
Buyers already pay. Google bid $10 million in 2026 for bankrupt Spirit Airlines’ emails, Teams chats and files (TechSpot), and SimpleClosure, which helps startups wind down, reports typical payments of $10,000 to $100,000 per company (Fortune). This guide covers who buys, what the GDPR, the AI Act and works council rules in Belgium, the Netherlands, France and Luxembourg ask of a seller, and how you get paid.
Key takeaways
- Buyers are AI labs and enterprise AI teams that train and test models. You approve each one by name and can block competitors, sectors or regions.
- Truly anonymous data is outside the GDPR, but anonymizing is itself processing, so you need a legal basis and a documented compatibility check first.
- Works councils or other employee representatives have information or consent rights in all four countries. In the Netherlands, a decision taken without required works council consent can be voided.
- The AI Act puts its training-data duties on the buyers, who must publish a summary of their training content, private datasets included. They need clean provenance from you.
- Selling through grokked costs you nothing: grokked takes a commission on each sale, and you’re paid by bank transfer within 7 days of each sale.
Who buys AI training data
The buyers are AI labs that train large models and companies that build and test their own AI models or agents. They want data that isn’t on the public web.
OpenAI says it wants datasets that are “not already easily accessible online to the public today” and runs a partnership track for private datasets (OpenAI). Anthropic lists “non-public datasets obtained from businesses” among its training sources (Anthropic). In the Spirit Airlines auction, Google bid $10 million, ahead of Mercor at $7.5 million, and Micro1 later proposed $12.5 million (Fortune).
Where a buyer is based is your call. On grokked, AI labs and enterprise AI teams preview de-identified samples in our catalog, you approve every buyer by name before anything is licensed, and you can block competitors, sector software vendors or whole regions.
The data that sells shows people solving real problems step by step: support tickets, code reviews and incidents, procedures, contracts and the chat and email around them. See who buys AI training data and what they pay for the full list and past deal prices.
The anonymization bar under the GDPR
The GDPR doesn’t apply to anonymous information. Recital 26 sets the test: take into account “all the means reasonably likely to be used, such as singling out, either by the controller or by another person” to identify someone (GDPR). If no one can identify a person that way, the data is anonymous.
The bar is high. The Article 29 Working Party’s opinion says an effective technique stops anyone from singling out a person, linking records about the same person or inferring information about them, and that “pseudonymisation is not a method of anonymisation” (WP29). Swapping a name for PERSON_1 isn’t enough when the message still names a client, a project or a price.
The recipient’s position matters. In EDPS v SRB, the EU Court of Justice confirmed in September 2025 that pseudonymized data need not be personal data “in all cases and for every person” (CJEU). A properly de-identified dataset can be anonymous for an AI lab while your originals remain personal data in your hands.
The European Data Protection Board’s draft anonymization guidelines of July 2026 add a wording rule: don’t describe data as anonymous or de-identified if people are still identifiable (EDPB).
Legal basis and the compatibility check
Anonymizing personal data is processing, so it needs a legal basis under article 6 of the GDPR (EDPB). With grokked, the basis is legitimate interests, and we give you a filled-in template for the assessment. The EDPB’s guidelines set three cumulative conditions, to be assessed and documented before processing starts: a legitimate interest, necessity, and a balancing test against the rights of the people in the data (EDPB).
Licensing is a new purpose, so you also run the compatibility test of article 6(4): the link between purposes, the context of collection, the nature of the data, the possible consequences for people, and safeguards such as encryption or pseudonymization (GDPR).
Skip consent. The EDPB considers it “problematic for employers” to rely on employee consent, because it is rarely freely given (EDPB). France’s CNIL treats legitimate interests as a possible basis for developing AI systems, provided strong safeguards are in place (CNIL).
Works councils by country
Under the GDPR, you tell employees about the new purpose before the further processing starts (art. 13(3)) (GDPR). Labor law adds collective rules. Most were written for workplace monitoring, and whether they reach data licensing is a matter of interpretation, so involve employee representatives early.
| Country | Rule | What it asks |
|---|---|---|
| Belgium | Collective agreement (CBA) no. 81 of 2002 | An employer installing a system to monitor electronic communication data informs the works council or, failing one, the CPPT/CPBW, the union delegation or the workers, and informs each worker concerned (CNT) |
| Netherlands | WOR art. 27(1)(k) | Works council consent for rules on processing and protecting employees’ personal data; a works council is mandatory from 50 people (WOR) |
| France | Code du travail L2312-38 and L2312-8 | In companies with 50+ employees, the CSE is informed before automated HR processing is introduced, and informed and consulted on new technologies (L2312-38, L2312-8) |
| Luxembourg | Code du travail L.261-1 and L.414-9 | Prior information to the joint committee or staff delegation before processing to monitor employees; a joint decision on monitoring installations in companies with 150+ employees (Legilux) |
In the Netherlands, a decision taken without the required consent is void if the works council invokes that in writing within a month (art. 27(5) WOR) (WOR). grokked writes the briefing for your staff or works council in your language.
Professional secrecy and NDAs
Confidentiality duties survive anonymization. GDPR recital 50 bars further processing that conflicts with a legal, professional or other binding obligation of secrecy (GDPR), and criminal law protects professional secrets in Belgium, France and the Netherlands:
- Belgium: article 352 of the new Criminal Code, in force since September 1, 2026 (eJustice, FPS Justice).
- France: article 226-13 of the Code pénal, punishable by one year in prison and a €15,000 fine (Légifrance).
- Netherlands: article 272 of the Criminal Code (Wetboek van Strafrecht).
That’s why grokked excludes client files for accountants, lawyers and healthcare providers; only the firm’s own templates and procedures qualify (details). Other companies should check client contracts and NDAs and leave out any client whose contract forbids sharing.
What the AI Act asks of buyers
The AI Act regulates AI providers, not the companies whose data they license. Since August 2, 2025, providers of general-purpose AI models must keep a copyright policy and publish “a sufficiently detailed summary about the content used for training” (art. 53(1)(c)–(d), art. 113) (AI Act).
The Commission’s template for that summary asks providers whether they obtained private datasets from third parties, “such as data obtained from providers of private databases, or data intermediaries” (European Commission). So buyers ask where data came from, under what agreement and how it was anonymized. For high-risk AI systems, article 10 adds data-governance duties that cover the origin of data (AI Act).
grokked supplies provenance documentation with every dataset. For the full legal picture, including the broker’s role as your processor and a pre-licensing checklist, read is it legal to sell company data to AI?.
This guide is general information about EU and national rules as of October 2026, not legal advice. For a decision about your company, ask your lawyer or data protection officer.
How you get paid
- Get an estimate. Pick your data types, team size and years. 60 seconds.
- Approve the scope. A 20-minute call. You pick the channels, folders and date ranges; nothing is included by default.
- We de-identify. Personal and confidential details are removed, and you approve the de-identified sample.
- A buyer licenses. AI labs preview de-identified samples in our catalog. You approve each buyer by name before a license is signed.
- You get paid. By bank transfer, within 7 days of each sale.
That’s about an hour of your time in total. You never pay anything: no sign-up, setup or exit fees, and listing costs €0. grokked is a broker, not a buyer. We license your dataset to AI labs on your behalf and take a commission on each sale.
Each license lasts at most 3 years, after which buyers delete their copies and certify it. Buyers may not re-identify, resell or reproduce your data verbatim, and they never see your company’s name. To compare grokked with other services, see where to sell AI training data: 10 brokers compared, or see how grokked sells company data to AI labs.
See what your data is worth.
Get an estimate in 60 seconds. Listing your data costs nothing.
Questions
Can I sell my company data in Belgium?
Yes. The GDPR applies directly in Belgium, as in every EU country, and truly anonymous data falls outside it (GDPR). Two Belgian rules come on top: CBA no. 81, under which an employer informs the works council or CPPT and each worker about systems that monitor electronic communication data (CNT), and professional secrecy under article 352 of the new Criminal Code (eJustice). Inform your staff before chat or email data is licensed.
Who buys company data in Belgium?
AI labs and enterprise AI teams that train and test models, wherever they are based. You approve each buyer by name and can block competitors, sectors or regions, so you decide who gets your data.
How much do AI labs pay for data?
There is no public price list. Reported payments for one company’s workplace data run from $10,000 to several hundred thousand dollars (Gizmodo, Fortune). The grokked estimator gives a range for your company in 60 seconds.
Can I sell data from a closed company?
It has been done. Spirit Airlines’ data was auctioned in its bankruptcy, and the sale required a bankruptcy judge’s approval (TechSpot); SimpleClosure handled nearly 100 such deals in a year for startups that shut down (Fortune). The GDPR still applies to personal data in the archive, so it should be anonymized before any buyer gets it.
Is selling anonymized data legal under the GDPR?
Yes, if the data is truly anonymous, because the GDPR doesn’t apply to anonymous information (GDPR). Anonymizing it is still processing, so it needs a legal basis (EDPB).
Does the AI Act apply to my company if I sell training data?
Its training-data duties fall on the AI providers that train models, not on you (AI Act). Your part is clean provenance: what the data is, where it came from and how it was anonymized, which your broker should document.
See what your data is worth.
Get an estimate in 60 seconds. Listing your data costs nothing.
Sources
- TechSpot, August 18, 2026. Google pays $10 million for 100 million Spirit Airlines emails and 500 million Teams chats to train AI
- Fortune, September 14, 2026. Little-known AI startup Micro1 tries to trump Google’s bid for bankrupt Spirit Airlines’ data
- OpenAI, November 9, 2023. OpenAI Data Partnerships
- Anthropic. Non-user privacy policy
- EUR-Lex, April 27, 2016. Regulation (EU) 2016/679 (General Data Protection Regulation)
- Article 29 Working Party, April 10, 2014. Opinion 05/2014 on Anonymisation Techniques (WP216)
- Court of Justice of the European Union, September 4, 2025. Press release No 107/25, Case C-413/23 P, EDPS v SRB
- European Data Protection Board, July 7, 2026. Guidelines 02/2026 on Anonymisation, version 1.0 (for public consultation)
- European Data Protection Board, October 8, 2024. Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR
- European Data Protection Board, May 4, 2020. Guidelines 05/2020 on consent under Regulation 2016/679
- CNIL, June 19, 2025. Développement des systèmes d’IA : la CNIL publie ses recommandations sur l’intérêt légitime
- Conseil National du Travail, April 26, 2002. Convention collective de travail n° 81 du 26 avril 2002
- wetten.overheid.nl. Wet op de ondernemingsraden
- Légifrance. Code du travail, article L2312-38
- Légifrance. Code du travail, article L2312-8
- Legilux. Code du travail (consolidated version)
- Belgian Official Gazette (eJustice). Code pénal of 29 February 2024, article 352
- FPS Justice, September 1, 2026. 1er septembre historique : entrée en vigueur du nouveau Code pénal
- Légifrance. Code pénal, article 226-13
- wetten.overheid.nl. Wetboek van Strafrecht
- EUR-Lex, June 13, 2024. Regulation (EU) 2024/1689 (Artificial Intelligence Act)
- European Commission, July 24, 2025. Explanatory notice and template for the public summary of training content for general-purpose AI models
- Gizmodo, April 17, 2026. Failed companies are selling old Slack chats and email archives to train AI
About the author
Nico Vergauwen
Nico Vergauwen is the founder of grokked, a data broker that licenses companies’ de-identified internal data to AI labs. Owners never pay anything and are paid within 7 days of each sale.