Selling information legally means clearing three stacked sets of rules: the federal statutes that protect specific categories of data, the state privacy laws that give consumers the right to opt out and force you to disclose what you’re doing, and, if any buyer or data subject sits outside the United States, the foreign rules that apply to cross-border transfers. Most of these regimes don’t ban data sales. They set conditions: what you can sell, whose permission you need first, what you have to tell people, and what happens when something goes wrong. Miss a condition and penalties at the federal level alone can reach tens of thousands of dollars per violation.
What You Can Actually Sell
Legal risk tracks how closely the data can be tied to a real person. Aggregate statistics drawn from large groups (say, a report showing 60% of users in a demographic prefer a product category) sit at the low end because no individual’s privacy is at stake. De-identified records, stripped of names, Social Security numbers, and addresses, sit just above that. Personally identifiable information (names, email addresses, phone numbers, purchase histories, browsing behavior tied to real individuals) is where the money is and where nearly every restriction below applies.
Business contact data (company names, job titles, professional email addresses) generally carries fewer restrictions than consumer data, with one hard federal rule attached. Under the CAN-SPAM Act, once someone opts out of commercial emails, you cannot sell or transfer that email address to anyone except a company helping you honor the opt-out. Each message sent to an opted-out address is a separate violation carrying penalties of up to $53,088, and the law applies equally to business-to-business email.
Federal Statutes That Restrict Specific Data
Four federal laws carve categories of information out of the general rule that data can be sold. If your records fall into any of them, the statute’s rules control.
Health Records (HIPAA)
The HIPAA Privacy Rule flatly prohibits covered entities and their business associates from selling protected health information unless the patient signs a written authorization for that sale. “Sale” is defined broadly as any disclosure where the entity receives payment in exchange for the data, directly or indirectly. Narrow exceptions cover public health activities, research where payment only covers the cost of preparing and transmitting the data, treatment and payment operations, and corporate mergers.1eCFR. 45 CFR 164.502 Outside those carve-outs, money for patient data means the patient has to sign off.
Student Records (FERPA)
Schools receiving federal funding cannot disclose personally identifiable information from student education records without signed, dated written consent from the student or parent. The consent must identify the specific records, the purpose of the disclosure, and the recipient.2Student Privacy Policy Office. FERPA – Protecting Student Privacy The statutory exceptions are institutional (transfers to a school the student is enrolling in, disclosures to financial aid administrators, reporting required by state law). None of them authorize commercial sales.
Credit and Background Data (FCRA)
The Fair Credit Reporting Act limits who can receive consumer reports and why. A consumer reporting agency can only furnish a report when the recipient has a “permissible purpose” such as evaluating someone for credit, employment, insurance, or a government benefit that requires a financial responsibility check.3Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports Selling report data to a buyer without a permissible purpose violates the statute. The Consumer Financial Protection Bureau has proposed extending the FCRA to data brokers that aggregate and resell consumer information outside the traditional credit reporting system.4Consumer Financial Protection Bureau. Fact Sheet: The CFPBs Proposed Rule to Rein in Sprawling Data Broker Industry
Children’s Data (COPPA)
The Children’s Online Privacy Protection Act requires operators of websites or online services directed at children under 13 to obtain verifiable parental consent before collecting any personal information.5Federal Trade Commission. Childrens Online Privacy Protection Rule (COPPA) Without that consent you cannot collect the data, and you cannot sell what you were not permitted to collect. Approved consent methods include signed forms, credit card verification, phone or video calls, and identity verification with facial recognition matching. Several states go further, prohibiting the sale of personal data from anyone under 16 without affirmative opt-in consent.
State Opt-Out and Disclosure Rules
Roughly 20 states now have comprehensive privacy laws in effect, with more scheduled to take effect in coming years. They share a common shape: consumers can opt out of the sale of their personal information, and businesses that sell data have to disclose that they do it.
The strictest frameworks define “sale” as any transfer of personal information for monetary or other valuable consideration. Cash isn’t required. Trading data for free services, advertising access, or other non-monetary benefits can trigger the same obligations. These laws also introduced a separate concept of “sharing” for cross-contextual behavioral advertising, meaning targeting ads to someone based on their activity across different websites or apps. Sharing triggers opt-out rights even when no money changes hands at all.
If you sell consumer data, you generally have to:
- Post a clear, conspicuous “Do Not Sell or Share My Personal Information” link on your homepage, typically in the footer. The opt-out process cannot require consumers to create an account.
- Honor opt-outs across your systems for at least 12 months before asking the consumer to reconsider.
- Update your privacy policy to list the categories of personal information you sell, the categories of buyers, and the consumer’s right to opt out.
- Apply heightened protections for minors. Multiple states prohibit selling data from consumers under 16 unless the consumer (or a parent, for younger children) affirmatively opts in.
Penalties are assessed per violation. As of 2025, the most aggressive state framework charges up to roughly $2,700 for unintentional violations and approximately $8,000 for intentional violations or violations involving minors’ data, both adjusted annually for inflation. In a breach that touches thousands of records, those per-violation numbers add up quickly.
Data Broker Registration
If you regularly collect and sell consumer data without a direct relationship with the consumers involved, you may fit the legal definition of a data broker. Several states now require data brokers to register with a state agency, pay annual fees, and make detailed public disclosures. The most expansive framework requires data brokers to access a centralized deletion mechanism at least once every 45 days, process all pending consumer deletion requests, and stop selling new data from consumers who have requested deletion. Additional requirements under that framework took effect in August 2026, mandating more detailed disclosures and streamlined deletion processing.
Registration thresholds can be low. In some states, entities that process data from as few as 10,000 consumers may qualify if more than 20% of revenue comes from data sales. Registration fees are modest compared with the administrative fines for failing to register when required, so if the threshold is close, it is generally cheaper to register than to argue about it later.
Selling Across Borders
If your buyers operate in the European Union, or your data includes information from EU residents, the General Data Protection Regulation applies. GDPR requires a “lawful basis” for processing personal data. Consent is one of six options, alongside contractual necessity, legal obligation, vital interests, public interest, and legitimate interests of the controller.6General Data Protection Regulation (GDPR). General Data Protection Regulation Article 6 Lawfulness of Processing For data sales specifically, consent is usually the only workable basis, because the other five rarely justify transferring personal data to a third party for commercial purposes.
Getting the data out of the EU adds a second layer. The European Commission can designate a country as having “adequate” data protection, which lets data flow freely. Without an adequacy decision, sellers must use standard contractual clauses approved by the Commission, binding corporate rules for intra-group transfers, or obtain explicit consent from individuals after informing them of the risks.7European Commission. What Rules Apply if My Organisation Transfers Data Outside the EU GDPR fines can reach 4% of global annual revenue.
The FTC Backstop
Even when no sector-specific federal statute applies, the Federal Trade Commission can pursue companies that sell data deceptively or unfairly under Section 5 of the FTC Act. In a recent enforcement action, the Commission prohibited a location data broker from selling sensitive location data tied to health clinics, religious organizations, political gatherings, and military installations, required the company to delete all historical location data it had collected, ordered it to build a program to identify and protect sensitive locations, and required a system for consumers to request deletion of their records.8Federal Trade Commission. FTC Takes Action Against Mobilewalla for Collecting and Selling Sensitive Location Data
Companies that receive an FTC Notice of Penalty Offenses and continue the prohibited conduct face civil penalties of up to $53,088 per violation, adjusted annually for inflation.9Federal Trade Commission. FTC Publishes Inflation-Adjusted Civil Penalty Amounts for 2025 Because the penalty is per violation, a company selling data on 10,000 consumers without proper consent isn’t looking at a single fine.
What to Put in Place Before the First Sale
The compliance work happens before any transaction. Sophisticated buyers also increasingly demand proof of compliance before signing, so this work makes the data easier to sell, not just safer.
Privacy Policy and Public Disclosures
Your privacy policy has to state plainly that you collect personal information and intend to sell or share it with third parties. Vague references to “partners” or “service providers” don’t satisfy disclosure requirements in states with comprehensive privacy laws. Spell out the categories of data collected, the categories of buyers, and the consumer’s right to opt out. If your data includes information from minors, disclose that separately.
Consent and Opt-Out Mechanisms
For most adult consumer data, the model is opt-out: the sale is allowed unless the consumer tells you no. That makes the opt-out mechanism the linchpin. Place the link prominently on the homepage and make sure it functions without account creation. For children’s data, and in many states for consumers under 16, the model flips to opt-in: you need affirmative consent before any sale. Consent forms should appear at account creation or data collection and clearly state what is gathered and how it will be used commercially.
Data Mapping
You need an internal picture of every data point you hold. Document where data lives, who can access it, what consent was obtained, and whether any opt-outs apply. Only records with proper permissions belong in the sales pipeline. Good mapping also gives you a defensible record if a regulator or a consumer challenges a specific transaction.
Contract Terms That Protect the Seller
The agreement governing the sale matters as much as the compliance work behind it. A well-drafted contract puts the cost of a failure on whoever caused it, which is where many sellers underprotect themselves.
Standard indemnification clauses require the party holding the data at the time of a breach to cover the resulting costs: forensic investigation, mandatory notifications to affected individuals, credit monitoring, call center support, and attorneys’ fees. Negotiate to limit your indemnification obligation to breaches caused by your own acts or negligence, so a buyer’s later security failure doesn’t come back on you if you met your contractual obligations. Some clauses further limit coverage to costs arising from third-party claims, excluding the internal costs of investigating a breach.
Beyond indemnification, the contract should address how long the buyer can retain the data, destruction requirements when the agreement expires, and restrictions on resale to fourth parties. Audit rights give you a way to verify the buyer isn’t using data beyond the authorized scope. Sellers who skip the contract review to close a deal faster are the ones who end up paying for the buyer’s mistakes.
Breach Liability After the Sale
Selling data doesn’t end your responsibility for it. Every state now has a data breach notification law requiring organizations to notify affected individuals when their personal information is compromised. If a buyer you sold data to suffers a breach, both parties may face notification obligations depending on who controlled the data at the time.
Under the broadest state privacy frameworks, consumers whose unencrypted personal information is stolen can sue the business that failed to maintain reasonable security practices. Statutory damages run up to $750 per consumer per incident, and class action exposure in a large breach can be enormous.10Office of the Attorney General, State of California. California Consumer Privacy Act (CCPA) Consumers have to give the business written notice and 30 days to cure before filing suit, but if the problem can’t be fixed, litigation follows. Reasonable security spending before a breach is dramatically cheaper than statutory damages after one.
Tax Reporting
Revenue from data sales is taxable. If you collect and sell data as an ongoing operation, the revenue is ordinary income, reported the same way as any other product or service revenue. If you sell an entire database as part of a broader business sale, the IRS treats each asset separately, with classification depending on whether the data qualifies as a capital asset, depreciable business property, or inventory.11Internal Revenue Service. Sale of a Business
If you take payments through third-party platforms or digital marketplaces, you may receive a Form 1099-K. The federal reporting threshold applies to payments exceeding $20,000 across more than 200 transactions in a calendar year, though some states set lower thresholds that generate a form sooner.12Internal Revenue Service. Understanding Your Form 1099-K The form reports gross payment volume, not profit, so it captures processing fees and refunds along with actual income. You owe tax on data sales income whether or not you receive a 1099-K; the form is a reporting tool for the IRS, not a trigger for your obligation.