AI Companies Mining Corporate Communications for Training Data: Privacy and Legal Concerns Emerge
Key Takeaways
- ▸AI companies are harvesting corporate communications including Slack and email as training data without explicit employee consent
- ▸The practice creates significant privacy and security risks, potentially exposing proprietary business information and personal employee data
- ▸Legal and regulatory uncertainty surrounds the legitimacy of using workplace communications for AI training, with potential violations of data protection laws
Summary
A growing practice among AI companies has raised significant concerns as they increasingly use corporate communications—including Slack messages, emails, and other workplace data—to train their large language models. This trend highlights a major gap between data collection practices and employee privacy expectations, as workers often have no awareness that their professional communications are being utilized for AI training purposes. The practice raises questions about consent, data ownership, and the proper governance of sensitive corporate information that may contain proprietary business details, client information, and personal communications between colleagues. Legal experts and privacy advocates are warning that this practice may violate existing data protection regulations and employment agreements, prompting calls for clearer policies and industry standards around the use of workplace communications for AI model development.
- The lack of transparency has created an awareness gap where employees are unaware their communications are being used for AI model development
Editorial Opinion
The use of corporate communications as AI training data represents a troubling example of how the rush to develop powerful AI systems can outpace ethical considerations and legal frameworks. While AI companies argue this data is necessary for training more capable models, the lack of transparency and consent from affected workers is deeply problematic. Organizations and policymakers must establish clear guidelines requiring explicit consent, data minimization practices, and robust oversight to prevent the wholesale commodification of employee communications.

