Updated October 2026
How to check an AI data buyer before you share anything
Find out who they are, who ends up with your data, and who pays whom, before any file leaves. Ask for a named company and website, the AI lab that will receive the data, a written offer, and how files are cleaned and deleted. Sellers often cannot see the end buyer, MIT Technology Review found.1
Step one
Who are you actually talking to?
Many ads give you no company to check. Most open a Meta Instant Form, not a website. Ask for the legal company name, a website with an address, and a named person. Pewter's site does not name its operator. A Meta page called Data Specialists links to a micro1 job post, which may mean it resells to micro1; it does not say so.2,3,4
Then ask: are you the buyer, or a broker? A broker passes you to a buyer and is usually paid a commission. Endless says it places data with micro1, Mercor and Handshake, which no buyer has confirmed. aitrainer.work says it introduces companies to buyers, is paid for referrals and never holds the data. That is a legitimate model, but you should know which one you are dealing with.5,6
Step two
Where does the data go?
Ask which AI lab will receive it, and whether you will be told. Several ads name Anthropic, OpenAI and Google, but a name in an ad is not a contract. MIT Technology Review reported that sellers often cannot see the end buyer.7,8,1
Ask how they get the data. Mercor's ads say it connects to the tools you already use. Frankfurt Kurnit, a law firm, advises giving a buyer no direct access to company systems, so prefer a buyer who takes an export you control.9,10
Step three
What do they promise, and will they write it down?
The ads are full of promises: client names swapped for codes, any folder excluded, never sold to competitors, raw files deleted within 30 days (Nyne); written offer before anything leaves (Supersoniq); you approve every sale (Goldmined.ai). Each is worth having. None is worth anything unless it is in the signed agreement.11,12,13,14,15,16
Check security claims you can verify. Mercor says it holds SOC 2 Type II. Also know its history: Mercor confirmed a cyberattack tied to the LiteLLM compromise in March 2026, and several class actions followed.17,18,19
Step four
Who pays, when, and how much goes to the middle?
You should not pay anything. Most buyers charge sellers nothing: Mercor, Polyshares and Ventra say so, though Ventra may add fees with notice. Most buyers pay within 2-8 weeks of signing: Mercor wires in 2-4 weeks, Cognor Labs quotes 3-6 weeks, and Polyshares and Ventra pay net 30 or 60. micro1 invoices only after it accepts the data in writing. If a broker is involved, ask how it is paid and whether that comes out of your price. Brokers and marketplaces can take 8% to 30%: FileYield charges sellers 8%, Jottings AI says its success fees typically run 20-30%, and Datarade takes 30%, 20% or 15% depending on plan.20,21,22,23,24,25,26,27,28,29,30
FAQ
Questions, answered with sources
Not always. MIT Technology Review reported sellers often cannot see the end buyer. Ask for it to be named in the agreement.1
We do not answer legal questions. Ask the licensing company: their team reviews this with you before anything is signed.
Before you sign
Legal questions go to the licensing company
We do not answer legal questions. Ask the licensing company before you sign: their team reviews these with you.
Questions for this kind of business
- Who indemnifies whom if personal data turns up after cleaning?
- Will the agreement name the AI labs that receive the data?
- How do CCPA, GDPR, UK GDPR and state privacy laws apply, and is de-identified data still personal information?
- Do customer, vendor or platform contracts, NDAs or API terms restrict this?
Questions for any buyer
- Is the license exclusive, and for how long?
- Can you sublicense the data, and to whom?
- Which AI labs will receive it, and will you tell us?
- How long do you keep it, and how is it deleted?
- What is your liability cap, and who indemnifies whom?
- Will the contract ban re-identification of people in the data?
- Who removes personal data, by what method, and do we approve it first?