Data licensing by industry describes which records companies in a given sector can license for AI training and which law, contract or control limits them. This index covers 29 industries, with every buyer request and rule dated as of November 9, 2026.
Buyers now publish sector lists: Handshake AI names 11 industries, and Mercor's referral feed carries 25 listings, 23 of them published on 2026-10-17, both checked 2026-11-09. The same record changes status by sector. A software company that owns its code can license its commit history, while a tax preparer needs each taxpayer's written consent under IRC 7216, a sector view of AI training data licensing that the rows below make explicit.
What does data licensing by industry mean?
The industry decides two things about a company's records: which of them AI buyers ask for, and which rule decides whether they can be licensed at all. A law firm and a software company may use the same document tools, yet only the law firm's matter files carry client secrecy. Four kinds of limit decide the question across all 29 sectors, in the order a seller usually meets them.
- Ownership: whether the company, a client, a partner or a contributor owns the work.
- Sector statute: a privacy or secrecy law written for the sector, such as HIPAA or GLBA.
- Export or infrastructure control: rules on who may see technical data, such as ITAR, the EAR and CEII.
- Platform or client contract: load-board, messaging-platform or client terms that bar passing data on.
Sector lists here are the buyers' own claims, checked 2026-11-09, not an assessment of demand by DataPacts. The index takes the operating company's view: what a firm already keeps, what a buyer has asked for in writing, and what stops the transfer.
The 29 industries at a glance
The table lists all 29 industries DataPacts covers, alphabetically, with the records buyers ask each to hold and the main rule that limits licensing them, as of 2026-11-09.
- Holds cells name the buyer whose own page states the request.
- "Not stated" means no request or rule was found, not that none exists.
- Each industry name leads to its own page as that page publishes.
| Industry | What buyers ask it to hold (stated by) | Main limit on record | Source |
|---|---|---|---|
| Accounting and tax firms | tax returns with workpapers, several filing seasons (Mercor) | IRC 7216 written consent; no sale of compilations | 26 U.S.C. 7216; Mercor listing /accounting |
| Automotive companies and dealers | not stated | 16 CFR 314.2 (leasing dealers); Data Act product data | ecfr.gov; CELEX 32023R2854 |
| Banks and financial firms | Payments & Fintech listing (Mercor); finance and insurance (Handshake AI) | GLBA notice and opt-out; SAR confidentiality | 15 U.S.C. 6802; 31 U.S.C. 5318(g)(2) |
| Biotech and life sciences labs | 1,000+ experiment runs, failed runs included, unpublished (Mercor) | sponsor- or partner-owned data (Mercor) | Mercor listing /research-lab |
| Construction and trades companies | drawings, RFIs, submittals, change orders, daily logs (Mercor) | not stated | Mercor listing /construction |
| Consulting and advisory firms | client deliverables in original files, 5+ years (Mercor) | right to license deliverables (client contracts) | Mercor listing /consulting |
| Contact centers | 1,000+ hours of consented calls, separate channels (Mercor) | recording consent (18 U.S.C. 2511; Cal. Penal Code 632) | govinfo.gov; CCAI order Dkt. 141 |
| Cybersecurity companies | alert-to-resolution records, private security software (Mercor) | customer data only with customer agreement (Mercor) | Mercor listing /cybersecurity |
| Education companies | long-form text, courses or video with AI rights (Mercor) | FERPA 34 CFR 99.31 for student records | ecfr.gov |
| Energy and utility companies | not stated | CEII 18 CFR 388.113; Data Act product data | ecfr.gov; CELEX 32023R2854 |
| Engineering and architecture firms | hardware and engineering (Handshake AI); records not stated | ITAR technical data; CEII designs | 22 CFR 120.33; 18 CFR 388.113 |
| Freight brokers, 3PLs, carriers and airlines | logistics and supply chain (Handshake AI); Spirit Airlines data schedule (Dkt. 1463) | load-board terms (DAT, Truckstop); 11 U.S.C. 363 | dat.com; truckstop.com; courtlistener.com |
| Game studios | owned chat, tickets, code, drives; a shipped title (Mercor) | other studios' footage excluded (ownership) | Mercor listing /game-studio |
| Hardware and product engineering companies | native multi-part CAD with feature trees (Mercor) | EAR deemed export; customer IP | 15 CFR 734.13; Mercor listing /hardware |
| Insurers | insurance (Handshake AI, HUMXN); records not stated | GLBA; StGB s.203 (private health, accident, life) | 15 U.S.C. 6802; gesetze-im-internet.de |
| Investment firms, hedge funds and quant traders | closed-deal data rooms, CIMs, models; proprietary time series (Mercor) | Regulation S-P safeguards | 17 CFR Part 248 |
| Law firms | complete closed-matter files, 500+ documents (Mercor) | client confidentiality (SRA Code 6.3; StGB s.203) | sra.org.uk; gesetze-im-internet.de |
| Managed IT service providers | not stated | not stated | n/a |
| Manufacturers | CAM programs, work orders with inspections, alarm logs (Mercor) | customer contracts (Mercor); Data Act product data | Mercor listing /manufacturing |
| Marketing, design and web agencies | Figma files with production code, 3+ years (Mercor) | client ownership (17 U.S.C. 201) | Mercor listing /design-agency |
| Medical practices and healthcare providers | EHR physician notes; DICOM with reports; recorded visits (Mercor) | HIPAA sale of PHI; de-identification | 45 CFR 164.502, 164.514 |
| Real estate firms | real estate (Handshake AI, HUMXN); records not stated | not stated | joinhandshake.com; humxn.io |
| Recruitment and staffing firms | HR and recruiting (HUMXN); records not stated | not stated | humxn.io |
| Retail and e-commerce companies | retail and e-commerce (Handshake AI); released product images (Mercor) | WhatsApp Business terms s.4.1(b), s.4.7 | facebook.com/legal (WhatsApp Business terms) |
| Semiconductor and advanced materials companies | run or build records with process settings and results (Mercor) | EAR deemed export; foundry-owned data | 15 CFR 734.13; Mercor listing /semiconductor |
| Software companies | never-public repositories, 3+ years of commits (Mercor) | code ownership (17 U.S.C. 201; CDPA s.11) | govinfo.gov; legislation.gov.uk |
| Telecom operators | CPNI as defined in 47 U.S.C. 222(h)(1); no buyer request stated | CPNI customer approval; ePrivacy Arts. 6, 9 | govinfo.gov; CELEX 02002L0058 |
| Video and photo production studios | owned footage with appearance releases, 100+ hours (Mercor) | appearance, model and usage releases | Mercor listing /video-studio |
| Wholesale distributors | not stated | not stated | n/a |
Four kinds of sector limits and the industries they reach
Four kinds of limits recur across the 29 industries: professional secrecy, sector privacy statutes, export and infrastructure controls, and ownership by clients, partners or platforms. The table maps each limit to the sectors it reaches, as of 2026-11-09.
| Limit | How it works | Industries it reaches | Example rules (source) |
|---|---|---|---|
| Professional secrecy | client or patient secrets need consent | law, accounting, consulting, healthcare, insurers | SRA Code 6.3; StGB s.203; IRC 7216 (sra.org.uk, gesetze-im-internet.de, ecfr.gov) |
| Sector privacy statutes | authorization, opt-out or customer approval first | healthcare, banks, insurers, investment, telecom, education, contact centers | HIPAA; GLBA; CPNI; FERPA; Cal. Penal Code 632 (ecfr.gov, govinfo.gov) |
| Export and infrastructure controls | release to a foreign person is an export; designs protected | semiconductors, hardware, engineering, manufacturing, energy | ITAR; EAR; CEII (ecfr.gov) |
| Ownership by clients, partners or platforms | records held but not owned, or not passable to third parties | agencies, consulting, cybersecurity, manufacturing, biotech, logistics, retail, automotive, energy | 17 U.S.C. 201; Data Act Art. 4; DAT, Truckstop and WhatsApp Business terms (govinfo.gov, CELEX 32023R2854, platform terms) |
These limits attach to records, not to whole sectors. GLBA reaches nonpublic personal information and ITAR reaches technical data, so one company can hold licensable and barred records side by side. The record-by-record exclusions sit on the page on what company data cannot be licensed for AI training.
What each group of industries holds and what limits it
The nine groups below follow the limit that decides them, with each buyer request dated and each rule cited.
Professional services under client secrecy: law, accounting and consulting
Law, accounting and consulting firms hold client files that buyers ask for by name, and client secrecy governs almost all of them. Mercor states, checked 2026-11-09, that it wants closed-matter files with 500+ documents and client consent or full anonymization, tax returns with workpapers across several filing seasons, and consulting deliverables from 5+ years of engagements.
The SRA Code of Conduct for Firms 6.3 (version of 2025-04-11) keeps clients' affairs confidential unless law permits or the client consents, and Germany's StGB s.203 covers lawyers, auditors and tax consultants. US preparers need each taxpayer's written consent (26 CFR 301.7216-3(a)), as set out under IRC Section 7216 for tax preparers.
Patient and laboratory records: medical practices and biotech
Medical practices hold the clinical notes and images buyers ask for most precisely, and HIPAA lets them license those records only once de-identified or under an authorization. Mercor states, checked 2026-11-09, that it wants EHRs with free-text physician notes for 2,500+ patients or 10 clinicians, DICOM studies with signed reports, and 1,000+ lab runs, with sponsor-owned data not a fit.
De-identified data falls outside the Privacy Rule (45 CFR 164.502(d)(2), 164.514(a)-(b)), while a sale of protected health information needs authorization (164.502(a)(5)(ii)). Substance use records carry their own consent regime (42 CFR Part 2), and the EU's Regulation (EU) 2025/327 opens secondary use through health data access bodies from 2029-03-26.
Customer financial records: banks, insurers and investment firms
Banks, insurers and investment firms hold nonpublic customer records that federal law lets them disclose to an outside buyer only after notice and an opt-out, and some records never. Handshake AI names finance and insurance, and Mercor runs Payments & Fintech, investment-firm and quant listings asking for data rooms and proprietary time series, checked 2026-11-09.
GLBA requires notice and an opt-out before nonpublic personal information reaches a non-affiliated third party (15 U.S.C. 6802(b)(1)), the rule behind GLBA and financial customer data. Suspicious activity report records cannot be disclosed (31 U.S.C. 5318(g)(2)), and amended Regulation S-P safeguards apply from 2025-12-03 for larger institutions.
Code, tickets and customer systems: software, cybersecurity and managed IT
Software companies hold the asset buyers describe most exactly, private code with long commit histories, and ownership of that code is the first question. Mercor states, checked 2026-11-09, that it wants never-public repositories with 3+ years of commits from 10+ engineers, and security records with customer data only under the customer's agreement.
A US employer owns works made for hire by employees, while contractor code needs a written assignment (17 U.S.C. 201(b), 101). The UK (CDPA 1988 s.11(2)) and Germany (UrhG s.69b) also vest employee code in the employer. No buyer states what it wants from managed IT providers.
Calls and network data: contact centers and telecom operators
Contact centers hold recorded calls, and the consent under which each call was recorded decides whether it can be licensed. Mercor states, checked 2026-11-09, that it wants 1,000+ hours of calls recorded with consent covering reuse. Telecom operators need customer approval to disclose individually identifiable CPNI (47 U.S.C. 222).
California requires all parties to consent (Cal. Penal Code 632(a)), unlike the federal one-party rule (18 U.S.C. 2511(2)(d)). In the Google contact-center case (N.D. Cal. 3:23-cv-05437-RFL), Dkt. 141 of 2026-10-22 dismissed three plaintiffs' claims with leave to amend; the case is not decided on the merits as of 2026-11-09. State rules sit under call recording consent rules.
Industrial and engineering records: manufacturing, hardware, semiconductors, engineering, construction and energy
Industrial companies hold long runs of production, design and project records, and export and infrastructure controls decide who may see them, including annotators. Mercor states, checked 2026-11-09, that it wants CAM programs and work orders, native CAD, 1,000+ owned process runs, and construction drawings and daily logs.
ITAR treats a release of technical data to a foreign person in the US as an export (22 CFR 120.50(a)(2)), as the EAR does for controlled technology (15 CFR 734.13). Infrastructure designs are protected (18 CFR 388.113(c)(2)), and the EU Data Act, Art. 4(13)-(14), applicable from 2025-09-12, ties product data to the user contract.
Freight, travel, vehicles and wholesale: logistics, automotive and distribution
Logistics companies hold shipment, dispatch and workforce records, and one airline's archive is the subject of a court-supervised auction. Spirit Airlines' data schedule lists 100,000,000 emails, 500,000,000 Teams items and 175,658 employee records, with 97,500,000 passenger profiles "Not Included" (Bankr. S.D.N.Y. 25-11897, Dkt. 1463).
A sale of personal information against a debtor's privacy policy needs an ombudsman and court approval (11 U.S.C. 363(b)(1)), a rule behind data assets in insolvency; the Spirit sale is not approved as of 2026-11-09. DAT Solutions, LLC bars AI training on its data (terms of 2026-07-30), and 16 CFR 314.2 treats dealers leasing vehicles for over 90 days as financial institutions.
Footage, games, client work and courses: studios, game studios, agencies and education
Studios, game studios, agencies and education companies hold creative work, and the question is whether the company or its client, cast or contributor owns the licensable rights. Mercor states, checked 2026-11-09, that it wants owned footage with appearance releases, a studio's own code and tickets, agency Figma files, and courses with AI-training rights.
Commissioned work is made for hire only in nine statutory categories with a signed agreement (17 U.S.C. 101), so agencies license client work only with cleared rights. Student records leave as de-identified only under 34 CFR 99.31(b)(1).
Customer-facing services: retail, real estate and staffing
Retail, real estate and staffing firms appear on buyers' sector lists, but no buyer on record states what records it wants from them. Handshake AI names retail and real estate, and HUMXN names HR and recruiting, checked 2026-11-09.
WhatsApp Business Platform terms (2026-09-23) bar selling Platform Data and AI training on it beyond the business's own fine-tuning (s.4.1(b), s.4.7).
Which buyer programs name which industries
Five programs among those DataPacts profiles publish their own sector lists or thresholds, and none of them covers all 29 industries. The table compares them alphabetically, as of 2026-11-09; every cell is the program's own claim.
| Program | Industries or areas it names | Sector thresholds | Checked | Source |
|---|---|---|---|---|
| Handshake AI | 11 industries, from finance and insurance to software | 20+ full-time employees and 3+ years (license and referral pages; Data Partnerships page states no minimum) | 2026-11-09 | joinhandshake.com/ai/data-partnerships |
| HUMXN Research Labs | 24 industries, from banking and finance to government contractors | not stated | 2026-11-09 | humxn.io/sell-company-data |
| Mercor | 25 listings (23 published 2026-10-17); 8 target industries on the program page | size band per listing | 2026-11-09 | api.data.mercor.com listings; mercor.com/data |
| micro1 | 6 functional areas, from software and engineering to operations and logistics | excluded categories (s.5.7) | 2026-11-09 | micro1.ai/data-partnerships |
| Mode | not listed by sector | 30+ employees; 10+ for accounting, finance, medical; 6+ for legal | 2026-11-09 | data.mode.inc |
A program without a published sector list is not absent from a sector. Mercor's program page names eight target industries, from legal and healthcare to logistics. micro1's Data License Master Terms s.5.7 (version of 2026-11-08) exclude, among other categories and unless the Order Form allows them, protected health information, biometric identifiers, financial account data, data of children under 18 and export-controlled information, which mirrors the sector limits above.
Filings and dockets that show sector data changing hands
Few sector deals have public terms; the ones that do sit in SEC filings, court dockets and the parties' own announcements. The table lists six by holder, as of 2026-11-09, and the tracker of AI data licensing deals records others.
| Holder | Sector | Counterparty | Date | What changed hands or was used | Value as stated | Source |
|---|---|---|---|---|---|---|
| Epic Systems Corporation | healthcare | none (own model) | paper v3, 2025-11-07 | de-identified Epic Cosmos data trained Epic's medical event models; 16.3 billion encounters, 118 million patients | n/a | arxiv.org/abs/2508.12104v3 |
| General Intuition US Inc. | games | clips uploaded by Medal players | checked 2026-11-09 | gameplay clips for world models and agents (General Intuition's claim) | not stated | generalintuition.com |
| Lions Gate Entertainment Corp. | studios | Runway AI, Inc. | 2024-09-18 | custom model trained on the Lionsgate catalog for Lionsgate use | not disclosed | runway.com/news |
| Spirit Airlines (debtors) | logistics (airline) | Google LLC (successful bid); Mercor.io Corporation (alternate bid) | 2026-08-14 | de-identified data; sale not approved as of 2026-11-09 | USD 10,000,000 and USD 7,500,000 (bids) | Dkt. 1463; Dkt. 1779 |
| Tempus AI, Inc. | biotech, healthcare | Pathos AI, Inc. | 2025-04 (10-K FY2025) | de-identified multimodal oncology dataset, solely to train a foundation model | USD 200 million in license fees over three years, incl. USD 50 million upfront | sec.gov, Tempus 10-K |
| Truveta Inc. | healthcare | not stated | checked 2026-11-09 | health-system data; lists AI training and validation as a use case (Truveta's claim, over 140 million patients) | not stated | truveta.com/about |
Two patterns appear. Tempus AI licenses an oncology dataset to Pathos AI for USD 200 million in license fees over three years, including USD 50 million upfront, per its 10-K for fiscal 2025, while Epic and Lionsgate train in-house or commission a custom model. At the Spirit Airlines auction on 2026-08-14, Google LLC made the successful bid of USD 10,000,000 and Mercor.io Corporation the alternate bid of USD 7,500,000 (Dkt. 1463); the sale is not approved as of 2026-11-09, with a hearing on 2026-11-17 (Dkt. 1779).
Sector benefits, risks, downsides and alternatives, including not licensing
Licensing sector records can earn revenue from archives a firm already keeps, but in regulated sectors the cost of a wrong record is a statutory penalty, not only a contract claim. The general question, should you sell or license your data, has its own page; the lists below apply it by sector.
Three benefits recur across sectors.
- Revenue from archives already kept, such as work orders and workpapers.
- Written demand: Handshake AI, HUMXN and Mercor each name healthcare, legal and manufacturing.
- A filed reference point in Tempus's oncology license to Pathos AI.
Three risks are specific to regulated sectors.
- Penalties checked 2026-11-09: USD 250 per disclosure, up to USD 10,000 a year, under 26 U.S.C. 6713(a), and up to two years under StGB s.203(6).
- Recording-consent litigation, as in the Google contact-center case.
- An unlicensed export when technical data reaches foreign annotators.
Two downsides come before any revenue.
- Consent or de-identification work, such as IRC 7216 consents or HIPAA de-identification.
- Buyer exclusions, such as micro1's s.5.7 categories.
Four alternatives remain open to every sector.
- Not licensing at all, which leaves every secrecy and export duty in place.
- Licensing only records free of client, partner or platform rights.
- An own or custom model, as Epic and Lionsgate chose.
- Permit routes such as the EU's health data access bodies.
How this sector index is built: primary rules, check dates and no fees
Each row cites the statute, regulation, filing or buyer page it rests on, with the date that source was checked. A cell reading "not stated" means no record was found, never that a rule or request was inferred.
No row is ordered or described by what a buyer states it pays, and deal ranges stay on each buyer's profile. DataPacts Editorial Team checked the rules and buyer pages cited here on 2026-11-09, following how we source, date and check every figure. This page is information, not legal advice.
Where a sector leads next: data types, law, buyers and the seller path
This index answers which sector holds what; the pages below answer which data type sells, which law applies where, who buys and in which order a seller works.
- Data types AI companies buy: what sells and who buys it.
- AI training data law by jurisdiction: copyright, privacy and contracts.
- Who buys AI training data: every buyer and program.
- Who sells data to AI companies: every seller type.
- Sell or license company data to AI companies: the seller guide.
- Choosing a buyer for your data: labs, vendors and marketplaces.
Frequently asked questions
Which industries license data to AI companies?
Legal, healthcare, finance, manufacturing, logistics, real estate and retail are the sectors named most often on buyers' own pages, checked 2026-11-09. Handshake AI names 11 industries, HUMXN 24 and Mercor's program page 8.
Can a law firm license client files for AI training?
Only with client consent or full anonymization, according to Mercor's own law-firm listing, checked 2026-11-09. Secrecy rules such as SRA Code 6.3 and StGB s.203 apply first.
Does HIPAA stop a medical practice from licensing patient data?
No, de-identified data falls outside the HIPAA Privacy Rule. A sale of protected health information still needs authorization, as the page on HIPAA and AI training data explains.
Can an accounting firm license client tax returns?
Only with each taxpayer's written, knowing and voluntary consent under 26 CFR 301.7216-3(a). Statistical compilations cannot be sold except together with the business (301.7216-2(o)(2)).
What is a sector's data worth to AI buyers?
No sector price list exists; every published range is the buyer's own claim with a check date. Methods and price points are compared under how much company data is worth to AI companies.