Can Companies Use Customer Data to Train AI? A Legal Review

Yes, companies can train AI on customer data, but only when their contracts, privacy commitments, and the law allow that specific use. Having the data isn't the same as having the right to train on it. What each customer agreed to when the data was collected, and what the company has promised publicly, set the limits.

The FTC required Everalbum to delete models and algorithms it built from users' photos in its final order. Zoom published an August 2023 explanation of how its terms and practices applied to AI, which it updated in February 2024.

GC AI, turnkey legal AI software used by 2,100 legal teams, including those at TIME, SKIMS, and Lockheed Martin, helps you check whether planned training is allowed before the product launches. It reviews each customer's agreements and identifies terms that allow or restrict the proposed training, with citations for you to check. For a broader contract-review framework, see our AI contract review guide.

What Customer Data Will the AI Model Use?

Start by asking exactly how the product team plans to use the data. Permission for one use may not cover another. “Improve our AI” is too vague to approve. Ask the product and engineering teams for:

• Source and contents: Which customers, collection dates, fields, attachments, personal data, and third-party material are included?
• Use: Which model and provider will the team use, and who is responsible for the work? Will the feature analyze data to answer a request, adapt a model for one customer, or train a model used across customers?
• Result and access: Who can use the model and anything created from it? Can either be reused for another product?
• Recipients and storage: Which internal teams, model providers, or other processors receive the data, and what do they retain or review? A provider's promise not to train on the data doesn't tell you how long it keeps the data or whether its staff can read it.
• Removal and change: Can the team exclude a customer from future training, remove source copies, or address a model trained on that data? Who is responsible for each step?

The Example: A Support-Ticket Model

Your product team messages Legal: “Can we use last year's support tickets to train a model that categorizes tickets for all customers if we strip out company names?” The feature is already on the roadmap.

The team wants to train one model for all customers using 2025 support tickets from three customers and the corrections support agents made to those tickets. Removing company names still leaves the ticket text, attachments, and corrections, so treat the records as identifiable until the team shows otherwise.

Do the Customer Terms Permit AI Training?

Only if each customer's terms allow it.

Permissions can differ from one customer to another, even when the records sit in the same support system. For each customer, review the signed agreement, order, data processing agreement (DPA), and amendments. Also check policies made part of the agreement, notices provided when the data was collected, and any later permission for training. Watch for an improvement or analytics clause that sounds broad but is defined to exclude the customer's content. Our SaaS agreement guide covers how AI training and output rights fit within a vendor negotiation.

Promises outside the contract count too. FTC staff guidance warns that companies providing AI models can face enforcement for failing to honor privacy and confidentiality commitments, including promises about training. The agency has also cautioned companies about changing terms or privacy policies to allow AI training on data already collected. Read customer-facing statements alongside the contract.

Check that the customer's permission covers the proposed training. You may still need other permissions to use personal information, third-party content, or confidential material in the dataset.

Ask privacy counsel to review whose data is included, how it will be used, what notices people received, who will receive it, and which laws apply. Confirm that the customer has the right to authorize the use. If the dataset includes data from multiple jurisdictions or regulated information, check those requirements before releasing it. For a broader view of privacy counsel's role in product decisions, see our related guide.

For the contract side of that review, add each customer's agreements to GC AI's Files along with the product team's request. Ask GC AI to organize the findings by customer and contract version, cite terms that allow or restrict training, and flag where permission is missing. Check the cited clauses to see which customers have agreed to the proposed use.

How One Customer's Terms Apply to the Example

For one of the three customers, the agreement limits processing to the services supplied to that customer:

Provider may process Customer Content solely to provide the Services to Customer.

Its separate improvement provision says:

Provider may use Usage Data to improve its products. Usage Data means service activity metrics and excludes Customer Content.

Under this agreement, ticket text and agent corrections are Customer Content. The improvement clause only permits use of service activity metrics, so it doesn't allow training a model for other customers on those tickets. Record the findings in a permission matrix, a table showing what each customer allows:

Review the other two customers' terms before combining their records. For each customer, record which document versions apply and the clauses that support your findings in the permission matrix.

What Permission Would Let This Training Proceed?

If the customer agreements don't allow the proposed training, consider these options:

• Evaluate on test data: The product team can keep testing with approved data created without customer records while Legal reviews permission to use the customer data. Check how that data was made; copying or relabeling customer tickets still requires a rights review.
• Limit the model to one customer: Training a model for one customer using only that customer's records may fit within the agreed Services. Ask Engineering to document who can access the model, how customer data stays separate, what outside providers do with it, and whether it can be reused. Then check whether the agreement permits that design. Limiting access alone does not give you permission.
• Get express permission: Specify which data will be used, how the model will use it, and who can use the model. Complete the privacy and third-party-rights reviews separately.

The Example's Permission Clause

In this example, company policy requires Legal's review, the customer's express permission, and completed privacy and third-party-rights checks before Customer Content can be used to train a model for other customers. The proposed clause covers each signing customer's listed ticket text and agent corrections and excludes attachments:

Sample Permission Clause

Customer authorizes Provider to use only that Customer's support-ticket text and support agents' corrections identified in Schedule A to train the support-ticket categorization model described in Schedule B for use across Provider's customers. Attachments are excluded. No other Customer Content or feedback is included. Provider may not use the approved dataset to train another model or develop another product without a further written agreement.

Fill in the schedules, safeguards, and terms for ending the permission. Check that the clause works with the rest of the agreement before sending it to the customer.

From Contract Review to a Decision the Product Team Can Use

After you check each customer's findings, use GC AI to draft the amendment and instructions for the product team. Check that the permission matrix, clause, and message all cover the same data and use.

Example Prompt

For each customer, check whether the agreement allows support-ticket text and agent corrections to be used to train a model for other customers. Return a table identifying the document that applies, the clauses that allow or restrict training, and any missing permission. Draft a permission clause for each customer that needs one.

Use Exact Quote to check each cited clause against the source document. If you need to check whether the proposed use matches the privacy notice, use Research to find relevant legal and government sources, then review the cited authorities. When a customer needs an amendment, edit it in GC AI for Word or in Easy Edit.

The Message to the Product Team

Give the product team a short update explaining what can continue, what is on hold, and who acts next.

For this example: training on the customer dataset is on hold because at least one agreement allows ticket content to be used only to provide that customer's services. Testing can continue with data created without customer records. Account managers are requesting permission, and Privacy is reviewing the personal data.

Legal will release the dataset once the amendments are signed and Engineering confirms which fields are included, who receives the data, who can use the model, and how removal will work. The released version excludes attachments and includes only records each customer has expressly permitted.

Keeping the Decision Current

Save the reviewed matrix, document versions, signed amendments, and approval record with the dataset documentation. Have Engineering confirm that training uses only the approved dataset and leaves out excluded records. The product team should name someone to ask Legal for a new review if the data, model, recipients, purpose, or customer terms change.

Use GC AI to review the customer agreements, draft any needed permission clauses, and prepare the product-team update. Check the cited terms before deciding whether training can proceed.