On October 13, Business Insider reported that AI labs are sending business owners six-figure “exploding offers,” 48 hours to answer, for their employees’ Slack DMs and emails. The data is priced by the terabyte, scrubbed of Social Security numbers and home addresses, and resold to the big labs. Employees, the story says, rarely know and almost never get paid.

The offer goes to the owner. Other people wrote the messages. That gap is what this post is about, and the decision that matters is who in your company has the authority to answer the broker’s email, settled before the email arrives.

My position: the default answer is that nobody sells. The exception runs through a short list of people with signing authority, a legal review and an inventory of what is in the archive. If that list doesn’t exist the day the offer lands, the decision belongs to whoever has the inbox open.

The offer is built to beat your approval process

Ryan Lock, cofounder of the broker Polyshares, told Business Insider these offers look like the ones Texas farmers got during the oil boom: “I’m offering you double market. I need an answer by Friday.” Forty-eight-hour deadlines, he said, have become common.

On the buying side, Micro1 announced a program earlier this year that pays midsize companies $100,000 to $2 million for anonymized data. Its chief revenue officer said buyers want to see how decisions get made, and that if a company won’t sell its Slack, CRM and email, the rest of the corpus is worth less. Value grows with the number of white-collar employees, and the story singles out law and accounting as especially in demand.

If your legal committee meets every two weeks, a 48-hour window doesn’t give it the chance.

Who can say yes

Five parties have a stake, and none of them covers the whole picture.

Who	What they actually control	What they don’t
Owner or CEO	The contract with the Slack or email vendor, and the commercial call	The personal data of each employee inside those messages
IT administrator	The technical export of the entire workspace	Authority. Being able to export is not being able to sell
Legal	Reading the contracts and the law that applies	Making the business decision
HR	The handbook, the employment contracts, and what staff were told	What the client agreements say
Your clients	What they pasted into a shared channel or emailed you, under their confidentiality terms	What your company does with it. Read those agreements before answering

Grant Gooley’s agency, MyPortal Marketing, sold Micro1 Figma and Canva files, client-onboarding checklists and Google ads, and he says he sold nothing client-specific. He drew that line alone. Someone needs to draw it in writing before the clock starts.

The risk also runs the other way. Former gig workers for Mercor, another AI training startup, allege in an ongoing lawsuit that the company encouraged them to upload work materials without their employers’ consent. Mercor denies it in court. Your own staff or contractors can be the route out, with no owner having signed anything.

What the law says, and where it goes quiet

I’m not a lawyer and this isn’t legal advice. This is what I verified.

In the United States, Emory law professor Ifeoma Ajunwa told Business Insider that the lack of federal privacy law leaves few legal barriers to companies using employee data for AI training. Her question is whether employees’ consent extends to the sale of that data, and she calls it ethically gray. In the European Union, article 5 of the GDPR requires personal data to be collected for specified purposes and not processed later in a way that is incompatible with them.

If your staff or your company are in Costa Rica, Ley 8968 on personal data protection applies. I read three articles, in my own translation:

• Article 2. The law covers personal data held in databases, manual or automated, of public and private bodies. It excludes databases kept strictly for internal purposes, as long as they are not sold or otherwise commercialized.
• Article 5. People must be told in advance the purpose, the recipients and the processing, and express written consent is required. Collecting data without informed consent is prohibited.
• Article 14. The holder of a database may transfer its data only when the data subject has authorized the transfer “expresa y válidamente,” expressly and validly.

My interpretation, and not a legal opinion: your company’s message archive sat under the internal-use shelter, and licensing it to a lab is selling it, which is exactly what article 2 carves out of that shelter. What I don’t know is whether a Slack workspace counts as a database under that law, or whether any article 5 exception helps you. A search turned up no ruling that settles it. That is for a local lawyer, with the text in hand.

Give your employment contracts and handbook the same read. A clause letting the company monitor its systems is written for security and compliance, and nothing in that wording says it covers a resale. If it doesn’t say so, don’t assume it allows it.

Scrubbed is not anonymous

Business Insider says brokers strip Social Security numbers and home addresses before reselling. A direct message without those two items still shows who wrote it, in what tone, to whom and about which client. That’s my inference: removing direct identifiers is not the same as anonymizing, and the story doesn’t explain each broker’s method, so I can’t say how much they actually clean.

Meta shows what trusting the label costs. When it announced a program to track employees’ keystrokes and mouse movements for AI training, staff revolted. The “supposedly anonymized” data, per screenshots Business Insider obtained, included private conversations and performance records, and it was viewable across the company in an internal leak. Meta suspended the project.

The Spirit Airlines case, where flight attendants held up Google’s purchase, has its own post.

What to decide before the offer arrives

Five items, in this order:

1. Who signs. One name and title, plus a second signature from legal. If the list says “management,” it isn’t finished.
2. A response rule. Every offer to license data gets logged and answered with “we’re reviewing it.” None is answered inside the buyer’s deadline.
3. An inventory. What sits in Slack, email, the CRM and tickets: client data, employee data, third-party data under confidentiality, regulated data.
4. A legal read. What your employment contracts, handbook and client agreements say today about uses other than the original one.
5. A clause with every vendor. No AI or collaboration vendor trains on your data or hands it on without your written authorization. I covered how to do that for API traffic in the post on OpenAI’s free tokens.

Item 3 is the one that takes real work, and it’s where IQ Source comes in. Before signing with any AI vendor, the first thing we do is inventory what data each process touches. In AI Maestro, the Process Reality Map documents how the company really operates, and that list is what tells your lawyer what is being licensed. Without it, the price conversation is about a closed box. Adam Liska turned down $200,000 for his company’s code, and I wrote up why I think he was right. If you run a law firm, you are in the category Business Insider flags as most sought after, and the law firm version of AI Maestro starts with exactly this.

This week, write down on half a page who would sign a data license and who would review it, and send it to your lawyer. Then forward yourself a test email dressed up as a broker’s offer and count how many hours it takes to reach those two people.