Could Your Resume End Up in AI Training Data? What Job Seekers Should Know

Introduction

Every time you apply for a job, you hand over a file. Your resume. Your phone number. Sometimes your salary history, your references, and a recruiter’s notes on how the phone screen went.

For years that file sat in a database and nobody thought much about it. That is changing. AI companies have started paying businesses for their internal records so they can train models on real work. Staffing and recruiting firms are on their shopping list.

That doesn’t mean your resume is being sold tomorrow. It does mean you should know where it lives, who can see it, and how to get it deleted.

Disclosure: I run howmuchismycompanydataworth.org, which introduces companies to AI data buyers and earns a referral fee from the buyer when a deal closes. I’m also a recruiter by background. I’ve seen both sides of this, and I think candidates should know how it works.

---

What’s Actually Happening

AI models learn from examples. The public internet has already been scraped hard, so the companies building these models want something the internet doesn’t have: the real, messy records of how businesses run. Emails. Chat threads. Support tickets. CRM notes.

A handful of companies now buy that kind of data directly from businesses. Scale AI, one of the biggest names in AI training data, lists Staffing & Recruiting among the industries it wants to hear from. It asks for records from tools like Slack or Teams, email, CRM systems, Jira, Zendesk and Google Drive.

Now think about what those tools hold at a staffing firm:

• The applicant tracking system or CRM holds your profile, your resume and every job you were submitted to.
• Email holds the back-and-forth about interviews, offers and counteroffers.
• Recruiter notes say things like “strong in Excel, wants $85K, can’t start until March.”
• Shared drives hold resumes, reference checks and client feedback.

Nobody is shopping for one person’s resume. Buyers want years of records from a whole company. But your resume could be one row in that pile.

---

This Isn’t Only Hypothetical

Records can change hands when a company goes under, too. When Spirit Airlines went through bankruptcy, its internal records went up for auction. Google won the August 2026 auction with a $10 million bid. The flight attendants’ union objected on privacy grounds, and at last report the court still hadn’t approved the sale.

That’s a major airline, not a small local agency. The lesson still carries over. A company’s records are an asset, and assets get sold, licensed or handed over when a business closes, merges or is acquired.

---

The Balanced View

Most of this isn’t sinister. Plenty of companies look into licensing their data and decide not to. A deal can be set up so names and contact details are removed before anything leaves the building.

There are also real rules on the company side. Even the FAQ for the data-licensing estimator I run is blunt about it: whether a company can share customer data depends on what those customers agreed to, the laws where they operate, and whether the data can be de-identified. It tells companies to talk to a lawyer before they sign anything, and it says employees shouldn’t license work records without the company’s approval.

Regulators have drawn lines too. In 2024 the FTC warned that companies quietly changing their terms or privacy policies to use data for AI training could be acting unfairly or deceptively.

The problem for you is simpler. You usually can’t see any of it. You don’t know which systems hold your file, how long it’s kept, or what any contract says. So ask.

---

What California Law Gives You

If you live in California, the California Consumer Privacy Act (CCPA), as amended by the CPRA, covers you as a job applicant. That wasn’t always true. Employee and applicant data had a temporary exemption, and it expired on December 31, 2022. The California Privacy Protection Agency’s FAQ says the law now covers California residents who are employees or job applicants.

Under the CCPA you can:

• Know what personal information a business has about you, where it came from, and who it shares it with. You can ask twice a year, free.
• Delete personal information the business collected from you. There are exceptions, such as records the business is legally required to keep.
• Correct information that’s wrong.
• Opt out of the sale or sharing of your personal information.
• Limit how a business uses sensitive information, like your Social Security number.
• Not be punished for using any of these rights.

Businesses have to confirm your request within 10 business days and answer within 45 calendar days. They can take 45 more days if they tell you. Opt-out requests have to be honored within 15 business days.

Two catches.

First, not every business is covered. According to the California Attorney General’s CCPA page, the law applies to for-profit businesses that do business in California and meet one of three tests: more than $25 million in annual revenue, buying, selling or sharing the personal information of 100,000 or more California residents or households, or making half or more of their revenue from selling California residents’ personal information. A large staffing company clears that easily. A small local agency might not.

Second, the rules depend on where you live. Other states have their own privacy laws, and how they treat job applicants varies. If you’re outside California, look up your state’s rules before you assume you have the same rights.

---

What to Ask a Recruiter

You don’t have to make it awkward. A good recruiter can answer each of these in a sentence:

1. Where will my resume and notes be stored? Which system, and who at your firm can see it?
2. Who outside your firm sees it? Will you send it to a client without asking me first?
3. How long do you keep candidate records?
4. Do you sell, license or share candidate data with anyone else? That includes AI and data companies.
5. Is my information used to train any AI tools, yours or a vendor’s?
6. How do I get my data deleted, and where do I send that request?

If a recruiter can’t answer, that tells you something. Ask for the firm’s privacy policy. Under the CCPA, a covered business’s privacy policy has to explain how to submit a request. Covered businesses are also supposed to tell you what they collect and why at the point they collect it, so look for a privacy notice on the application page.

---

How to Request Deletion

When you’re done with a firm, or you just don’t want them holding your file, here’s how to ask:

1. Find the privacy policy. Look for a section like “Your California Privacy Rights” or “Privacy Requests.” It should list how to submit a request, often a web form, an email address or a toll-free number.
2. Use that method. Don’t just reply to your recruiter’s last email. The attorney general’s guidance says to use the business’s designated method, which may be different from its normal contact info.
3. Be specific. Give the job you applied for, roughly when, and the email and phone number they have on file.
4. Expect to verify who you are. That’s normal. It stops strangers from deleting or pulling your records.
5. Keep a copy. Note the date you sent it. The 45-day clock starts when they receive it.
6. If they ignore you, file a complaint. The CPPA takes complaints through an online complaint form. It doesn’t represent individual consumers, but complaints are how it finds problems.

Here’s a simple email you can adapt:

Subject: Request to Delete My Personal Information

Hello,

I’m a California resident. Under the California Consumer Privacy Act, I’m asking you to delete the personal information you collected about me as a job candidate, including my resume, application, interview notes and related emails.

I applied for the [Position] role around [Month, Year]. The email and phone number you have for me are [email] and [phone].

Please also tell me whether you have sold, shared or licensed my information to any third party, including AI or data companies.

Thank you, [Your Name]

---

Protect Yourself Before You Apply

The easiest data to protect is the data you never send.

• Leave sensitive details off your resume. No Social Security number, date of birth, driver’s license number or photo. City and state are enough for your address.
• Use a separate email for your job search. It’s easier to track who has it, and easier to shut down later.
• Keep a short list of who has your resume. Firm, recruiter, date. When you land a job, you’ll know where to send deletion requests.
• Read before you upload. Mass-apply tools and unfamiliar job boards collect a lot. Check the privacy policy before you hand over your work history.

---

The Bottom Line

Your resume isn’t likely to be singled out and sold. But it lives in systems that are now worth money to AI companies, and that’s new. If you’re in California, you have real rights over that data. Ask recruiters where your information goes and how long they keep it. And when you’re done with a firm, ask them to delete it.