Is selling data legal?

Whether a particular data sale is legal turns on three things: whether the seller has the right to license the data at all, whether the data is about identifiable people, and where those people and the parties are.

Most trouble comes from the first question, not the privacy laws: data collected under terms that forbid resale, licensed from a partner on restrictive terms, or scraped in breach of a site's terms.

Four states require data brokers to register. Each defines a broker, roughly, as a business that sells or licenses personal information about consumers it has no direct relationship with. Brokering a company's codebase or de-identified business records usually sits outside these laws; selling consumer records usually does not.

California: broader than a cash deal

Under California's privacy law, a sale is broader than a cash deal. It covers selling, renting, releasing, disclosing or making personal information available to a third party for money or other valuable consideration. Consumers can opt out of sales, and businesses must say in their privacy notice whether they sell. Several other states copied this structure.

EU and UK: a lawful basis for every use

In the EU and UK, the GDPR has no sale-specific rule. Instead every use needs a lawful basis under Article 6, and the buyer must usually tell people where their data came from under Article 14. In practice that makes selling personal data about EU residents hard without consent or a carefully argued legitimate interest.

1. 1

   Trace where the data came from

   Ask the seller how each part was collected and under which terms: customer terms, privacy notice, partner contracts, scraping, open-source licences.

2. 2

   Find any personal data

   Look for names, emails, device ids, location, voices and faces, and free text that may contain them. Decide whether it can be removed or de-identified before sale.

3. 3

   Map the people and places

   Note which states and countries the people live in and where the buyer is. That decides which laws apply.

4. 4

   Check registration

   If the deal sells personal data about people the seller doesn't deal with directly, check each state registry above.

5. 5

   Screen the buyer

   Confirm who ultimately owns the buyer and what it will use the data for, including any limits under the DOJ bulk data rule.

6. 6

   Put the limits in the licence

   Field of use, no re-identification, no onward sale, deletion at the end, and warranties from the seller about its rights.

• Any deal with personal data, and every deal with sensitive data. The FTC has acted against data brokers selling precise location data, including a 2024 order against X-Mode Social.
• Cross-border deals, or any buyer with foreign ownership you can't trace.
• Data collected by scraping, or under terms you haven't read.
• This page covers the US and EU in outline only. Other countries, and US sector laws for health, finance and children's data, add rules not covered here.