Is it legal to sell company data?

Your customer contracts and privacy notice set the ground rules for how you may use what customers gave you. Many allow aggregated or de-identified use. Some say nothing. A few rule out sharing. Read them first.

Resist rewriting your privacy notice and then licensing the old records under the new wording. In February 2024, FTC staff warned that adopting looser data practices, such as using customer data for AI training, and telling people only through a quiet, retroactive change to the terms of service or privacy policy could be unfair or deceptive. The post leads with AI companies, but its reasoning covers any business: don't repurpose data by changing the promises afterward.

License only what your existing promises cover, and update your notice, with real notice to people, for data you collect from now on. Contracts with clients, insurers, general contractors and owners can carry their own confidentiality clauses, so pull the ones that touch the records in scope.

This is where licensing operating records and trading in personal data part ways. A buyer of operating records wants to see how the work went, not who the customer was. If names, addresses, phone numbers, emails, and account and claim numbers come out and the record still shows what happened, the buyer gets what it came for without learning who anyone was.

California's privacy law is a useful yardstick even if you never touch California. It treats information as deidentified when it can't reasonably be used to infer information about, or be linked to, a particular consumer, and the business holding it does three things: takes reasonable measures to keep it from being tied to a consumer or household, publicly commits to keep it deidentified and not try to re-identify it, and contractually binds recipients to the same. Deidentified information falls outside the law's definition of personal information.

The hard part is free text and photos. A job note that says "the Alvarez place on Lake Road, call after five" carries a name and a location in one sentence. Photos can show faces, house numbers and plates. Good de-identification handles those too, and the license should bar buyers from reversing it.

We broker companies' own operating records: the files, tickets, calls, photos, ledgers and emails produced by running a business, whether that's a software company, an insurance agency or a roofing contractor. We don't deal in consumer profiles, meaning lists of people with their contact details and habits. That line is deliberate. It keeps every deal about how the work gets done, not about who your customers are.

What that means here:

• Buyers see an anonymized summary before signing: sector, region, size bands, years of history and volumes. Never your name or your customers.
• Identifiers are removed before anything is delivered under the license.
• We don't take custody of your raw data.
• Buyers agree not to re-identify anyone or contact the people in the records.

Some categories carry their own rules, so they stay out of scope unless you raise them on a call and sign off:

• HR and payroll records, including reviews and discipline
• Financing and credit applications
• Tenant, applicant and other screening reports
• Health and injury details, such as those that turn up in claim files or patient records
• Data you hold for clients, including customer data inside a software product you run, and content a vendor licenses to you
• A law or accounting firm's client files, unless the clients give documented consent

Income tax return information is never in scope, with or without consent. Law and accounting firms covers why. Recorded calls get their own review, because consent rules differ by state. See call-recording consent.

We're not your lawyer, and this page is not legal advice. Laws differ by state and by facts, and they change. Ask your counsel to:

1. Confirm which records are yours and which are held for others.
2. Read your customer agreements, vendor terms and privacy notice for what they allow.
3. Check call-recording consent for the states you operate in.
4. Check any rules specific to your field, such as client confidentiality for law and accounting firms or health and financial privacy laws.
5. Review the license itself: scope, use limits, de-identification, deletion and what happens at the end of the term.

Our intake asks about the first four and flags the gaps, so you arrive with a short list. Nothing moves until you sign a license.