Can I sell my company's customer data? Six legal questions to answer first

Can you sell your customer data? Sometimes. Less often than most owners think.

It depends on three things: what you promised your customers, what the data holds, and which laws cover them.

This is not legal advice. Laws change often. It is a map of the questions a lawyer will ask, so your first meeting is shorter and cheaper.

1. What did your privacy policy and contracts promise?

Start with your own words. If your privacy policy says you don't sell or share customer data, selling it breaks that promise. Regulators treat broken privacy promises as deception.

Changing the policy today does not fix the past. In early 2024 the FTC issued a warning. Quietly changing your terms to use old data in new ways, such as AI training, could be unfair or deceptive. New terms usually apply only to data you collect after the change, with clear notice.

Check your customer contracts too. Business contracts often limit what you can do with a client's data, no matter what your privacy policy says.

2. Does the data include personal information?

Most privacy laws cover only information about people who can be identified. That covers more than you'd think. Names, emails and phone numbers count. So do device IDs, IP addresses and any mix of details that points to one person.

Business contacts count too. A buyer's name and work email at a client company is personal information under Europe's GDPR. California's law covers it as well, since its business-to-business exemption ended in January 2023.

3. Which privacy laws apply to your customers?

What matters is where your customers live, not only where you are.

California (CCPA/CPRA). The law defines "selling" broadly. It includes sharing personal information for money or anything else of value. If you sell or share it, you must tell people. You must add a "Do Not Sell or Share My Personal Information" link. And you must honor opt-outs.

Other US states. More states pass privacy laws each year. Many let residents opt out of the sale of their data. Virginia, Colorado, Connecticut, Texas and Oregon are among them.

Europe and the UK (GDPR). You need a legal reason for any new use of personal data. You must also tell people about it. Selling personal data usually needs consent, or a carefully documented business reason. Sending data outside Europe adds more rules.

4. Can you remove personal details or sell summaries instead?

This is how most legal data deals work. Many privacy laws, California's included, don't cover data that is properly de-identified or summarized.

"Properly" matters here. Deleting names is not enough if someone can still identify people from what's left. California also requires you to promise publicly not to re-identify the data. Summary figures, like average order size by state, are far safer than single customer records.

5. Would selling customer data make you a data broker?

California, Vermont, Texas and Oregon require data brokers to register. The rules vary. In general they cover businesses that sell data about people they don't deal with directly.

If you sell data about your own customers, you may not count as a broker. Your buyer probably does. They will want proof that you collected the data legally.

California's Delete Act adds one more rule. From August 2026, registered brokers must handle deletion requests sent through the state's central system.

6. Do special industry rules apply?

Some data carries extra rules on top of general privacy law:

• Health data from doctors, insurers and their vendors falls under HIPAA.
• Financial data held by banks and other financial firms falls under the Gramm-Leach-Bliley Act.
• Student records fall under FERPA.
• Children's data collected online falls under COPPA.

If your data fits one of these, selling it is much harder. Often it is off the table.

How companies sell data legally

Companies that sell or license data well tend to follow the same five steps:

1. Sell insights, not records. Summaries and benchmarks avoid most privacy problems.
2. Remove personal details with care when a buyer needs single records. Write down how you did it.
3. Update your privacy notice before you collect the data you plan to license, not after.
4. Put limits in the contract: no re-identifying people, no resale, deletion when the deal ends.
5. Have a privacy lawyer review the deal before you sign.

Frequently asked questions

Is it legal to sell customer data in the US?

No federal law bans it outright. But state privacy laws, industry rules like HIPAA, and your own privacy promises all limit it. In many states, customers can opt out of the sale of their data.

Is anonymized data still personal data?

Truly anonymous data generally is not. But the bar is high. If people can be identified by combining fields, regulators treat it as personal data.

Can I sell data about my business customers?

Data about the companies themselves is mostly unregulated, apart from your contracts. Data about the people who work there is personal information under GDPR and California law.

Do I need a lawyer to sell company data?

For anything with personal information, yes. A clear estimate and a clear picture of your data will make that meeting shorter.

Before you go further, learn what your data is worth. Get a free estimate.