Updated October 2026
How to check an AI data buyer before you share anything
An ad says your company's data is worth money, and now someone wants a call. Before any file leaves, find out who they are, who ends up with your data and who pays whom: ask for a named company and website, the AI lab that will receive the data, a written offer, and how files are cleaned and deleted. Sellers often cannot see the end buyer, MIT Technology Review found.1
Step one
Who are you actually talking to?
Many ads give you no company to check. Most open a Meta Instant Form, not a website. Ask for the legal company name, a website with an address, and a named person. Pewter, for example, names its operator, Buzzlead.io LLC, in its privacy policy but names no people. A Meta page called Data Specialists links to a micro1 job post, which may mean it resells to micro1; it does not say so.2,3,4
Then ask: are you the buyer, or a broker? A broker passes you to a buyer and is usually paid a commission. Endless says it places data with buyers such as micro1 and Mercor, which neither has confirmed. aitrainer.work says it introduces companies to buyers, is paid for referrals and never holds the data. That is a legitimate model, but you should know which one you are dealing with.5,6
Step two
Where does the data go?
Ask which AI lab will receive it, and whether you will be told. Several ads name Anthropic, OpenAI and Google, but a name in an ad is not a contract. MIT Technology Review reported that sellers often cannot see the end buyer.7,8,1
Ask how they get the data. Frankfurt Kurnit, a law firm, advises giving a buyer no direct access to company systems. Where a buyer does connect, ask exactly what kind of access it wants: read-only access to sources you approve, your own staff signing in without handing over passwords, or files you export yourself.9,10,11,12
Step three
What do they promise, and will they write it down?
Buyers make plenty of promises: that any folder can be left out, that you see a cleaned sample before you sign, that client names become codes, and that raw files are deleted soon after processing. Each is worth having, and none counts unless it is in the signed agreement.10,13,14,15,16
Check security claims you can verify. Mercor says it holds SOC 2 Type II. Also know its history: Mercor confirmed a cyberattack tied to the LiteLLM compromise in March 2026, and several class actions followed.17,18,19
Step four
Who pays, when, and how much goes to the middle?
You should not pay anything. Most buyers charge sellers nothing, and brokers and marketplaces can take 8-30%. On timing, speeds vary, but it's usually around 3-6 weeks, sometimes longer. If a broker is involved, ask how it is paid and whether that comes out of your price, and get the payment date in the agreement.20,21,22,23,24,25,26,27,28,29,30
FAQ
Questions, answered with sources
Not always. MIT Technology Review reported sellers often cannot see the end buyer. Ask for it to be named in the agreement.1
Every business is different, so this one is best talked through with the buyer you're working with. Their team goes over it with you before anything is signed.
Before you sign
Questions to talk through with your buyer
Every business is different, so these are best talked through with the buyer you're working with. Their team goes over them with you before anything is signed.
Questions for this kind of business
- Who indemnifies whom if personal data turns up after cleaning?
- Will the agreement name the AI labs that receive the data?
- How do CCPA, GDPR, UK GDPR and state privacy laws apply, and is de-identified data still personal information?
- Do customer, vendor or platform contracts, NDAs or API terms restrict this?
Questions for any buyer
- Is the license exclusive, and for how long?
- Can you sublicense the data, and to whom?
- Which AI labs will receive it, and will you tell us?
- How long do you keep it, and how is it deleted?
- What is your liability cap, and who indemnifies whom?
- Will the contract ban re-identification of people in the data?
- Who removes personal data, by what method, and do we approve it first?