Can you sell Slack data to AI? Licensing Slack, Teams and email archives in the UK

Why do AI buyers want workplace chat and email?

Because public text does not show how decisions get made inside a business. Chat and email do: who asked whom, what was disputed, how a problem was resolved. Buyers use them to train and test AI agents on realistic office work.

Scale AI says it wants "full conversation histories, threads, participants, and reply structure preserved intact" from Slack, Microsoft Teams and Google Chat, and email threads from Gmail and Outlook². Mercor lists Slack, Teams, Gmail and Outlook among more than 100 tools it connects to¹, and micro1 lists internal communications among the records it buys³. Surge AI told MIT Technology Review that one company's Slack history, if it captures conversations with variety and depth, can be worth more than another company's Slack, email and calendars combined⁴.

That richness is also the problem. Ordinary work email carries personal details: a lawyer quoted by MIT Technology Review pointed to doctor appointments, school pickup arrangements and date-night plans lurking in emails and calendars⁴. More on what buyers look for is in what AI companies buy.

Who owns the messages your staff write?

For work messages, usually the company. Under UK copyright law the employer is the first owner of copyright in work an employee creates in the course of employment, unless agreed otherwise¹². Ownership does not settle the privacy question, though.

Three limits apply. Messages an employee writes for their own purposes are not made in the course of employment¹². Messages written by customers, suppliers and other outsiders belong to them. And whoever owns the copyright, any message that identifies a person is personal data, which UK GDPR protects until it is effectively anonymised¹⁰. The full legal map is in our UK law guide.

Do you need staff consent?

Usually not, and asking for consent is often the wrong tool. The ICO says consent "will not usually be appropriate if there is a clear imbalance of power", naming employers specifically, and that employers should look for another basis such as legitimate interests¹³.

Legitimate interests brings duties of its own. You must balance your interest against your staff's, tell them before the new processing starts¹⁴, and respect their right to object, after which you must stop unless you show compelling legitimate grounds²⁰. The ICO also says the anonymisation step is itself processing that needs a lawful basis and must be explained to people¹⁰.

Not everyone agrees the law goes far enough. Emory law professor Ifeoma Ajunwa told MIT Technology Review that "employers should have express consent before selling workers' data"⁴, and told reporters the consent question is an "ethically gray area"⁹. A practical middle course: rely on legitimate interests, but offer a genuine opt-out that removes an objector's mailbox and messages from scope.

Which messages should never be licensed?

Anything private, sensitive or about someone's employment relationship. Leave these out before de-identification starts, rather than relying on de-identification to catch them.

The Spirit Airlines case shows where staff draw the line. Google won an auction for Spirit's records for USD 10 million^4,9. The archive was reported in September as about 100 million emails and 500 million Teams messages²¹; Skift reported on 10 November that, under revised terms set out in a court filing, Google is to receive roughly 1.9 billion internal emails and 664 million Teams items⁶. Bloomberg Law said the deal exposed "a void in privacy protections for workers"⁵, and more than 120 US lawmakers urged Google and Spirit to protect former employees' privacy⁹. On 10 November 2026 the unions dropped their objections after Google agreed to a more rigorous de-identification process and the exclusion of employee health and medical information^6,7,8. Other reports list drug and alcohol testing records, disciplinary documents and identification documents among the exclusions, with an independent verification specialist and a ban on re-identification⁸. The sale still needs court approval, with a hearing set for 17 November 2026⁶.

How should you tell your staff?

In writing, in plain language, before any export or processing begins¹⁴. Tell them what is in scope, what is excluded, how personal data is removed, who the buyer is, how to object and whether staff will share in the proceeds.

The ICO's data sharing code asks controllers to "consider when and how you will inform data subjects about what is happening"¹¹. If you recognise a trade union or run a staff forum, brief its representatives before the announcement. Do not let a buyer's deadline cut this short: IBTimes UK reported six-figure offers made with as little as 48 hours to decide⁹. We suggest allowing at least 30 days between the notice and any processing, so people have time to ask questions and object; that is our recommendation, not a legal deadline.

Staff notice template (adapt with your solicitor)

Licensing our workplace records for AI research and development

[Company] plans to license a de-identified copy of some of its work records to [buyer], which supplies data used to train and test AI systems. We are telling you before anything is processed.

What is included: messages in [named work channels] and [business mailboxes] from [start date] to [end date].

What is excluded: direct messages, private channels, HR, payroll, health, disciplinary and grievance records, and [other exclusions].

How your personal data is protected: names, contact details and other identifying information will be removed by [who], [where], to [standard], [before the copy leaves [Company] / after transfer, under the buyer's process described in [document]]. The licence forbids any attempt to re-identify people.

Our legal basis: our legitimate interests. You have the right to object. If you do, we will remove your mailbox and messages from scope [or explain the compelling grounds for not doing so].

Proceeds: [state whether staff will share in the proceeds, and how].

Questions or objections: contact [name and email] by [date, at least 30 days away]. You can also complain to the Information Commission's Office (ICO).

Should staff share in the proceeds?

There is no legal requirement, but it is a fair question and you should answer it before staff ask. Reporting on this market says employees "may receive no share of the proceeds"⁹, and in wind-down sales the money typically flows to senior creditors and investors⁴.

The decision is yours. If you choose to share, possible forms include a one-off bonus pool, a contribution to a staff welfare or training fund, or a donation chosen by staff. Each has tax and contractual consequences, so take advice. Whatever you decide, say it in the staff notice.

How are Slack, Teams, Gmail and Outlook exported and de-identified in practice?

Each platform has an administrator export route with its own limits, and buyers also offer direct connectors. Agree the route before signing, because it decides who touches raw messages and where.

On de-identification, buyers differ. Scale AI says it anonymises everything inside your environment before extraction²; Mercor's platform extracts and de-identifies, and Mercor says no buyer sees raw data¹; micro1 says you need not anonymise before transfer³. Sleeping Asset prefers personal data to be removed before records leave your systems; where a buyer removes it after transfer, we tell you in writing first and your solicitor confirms the transfer route before anything moves. The ICO is clear that swapping names for codes is pseudonymisation and the result is still personal data¹⁰. Free text needs as much care as headers and signatures. Our method and standard are on the anonymisation page, and the licence terms to insist on are in our data licence agreement guide.

If you are weighing whether your archive is worth the effort, our valuation page sets out what buyers publish, and how we are paid explains why the buyer, not you, pays our fee. On a 30-minute call we can talk through which channels and mailboxes could be in scope.