Can you sell a customer list? What the rules say and what to license instead

The short answer: it depends on promises, laws and contracts

A business can often transfer its customer list when it sells the whole company, because the list moves with the goodwill it supports. Selling or licensing that list on its own, to an unrelated third party, is a different act. It can collide with the privacy policy in force when the data was collected, with state privacy statutes, with sector rules for financial or health data, and with confidentiality clauses in customer contracts.

Three questions decide most cases:

1. Promises: what did the business tell customers about selling, sharing or reusing their information when it collected it?
2. Laws: which privacy rules reach this data, given where the customers live and what industry the business is in?
3. Contracts: do customer agreements, NDAs or data-vendor licenses treat customer identities or transaction details as confidential?

A B2B list and a consumer list are not treated the same way, and neither are a list that moves inside a company sale and a list rented to a marketer. The rest of this page walks through the rules and the common situations.

What do the rules actually say?

No single US law governs customer lists. Several regimes overlap, and the strictest one that applies usually sets the limit.

• Privacy promises are enforceable. In a January 2024 staff post, the Federal Trade Commission said that promises a company makes about how it uses customer data, including not using it to train or update models, can be enforced whether they appear in a privacy policy, terms of service or marketing (FTC staff post on privacy commitments). A month later, FTC staff added that adopting more permissive practices, such as sharing data or using it for AI training, and disclosing them only through a quiet retroactive change to the terms could be unfair or deceptive (FTC staff post on changing terms). Both are staff guidance, not rules.
• California regulates selling and sharing. For businesses covered by the California Consumer Privacy Act, the notice at collection must say whether personal information is sold or shared, and a business that sells or shares personal information must have a written agreement limiting the recipient's use to specified purposes (California Civil Code 1798.100 et seq.). The definitions in section 1798.140 decide whether a given transfer counts, so read them before assuming a license falls outside them. Other states have their own consumer privacy laws, and the definitions vary by state.
• Financial customer data has its own rule. Financial institutions under the FTC's jurisdiction must give customers privacy notices and, before sharing their information with certain nonaffiliated third parties, opt-out rights under the Gramm-Leach-Bliley Act (FTC guidance on the Gramm-Leach-Bliley Act).
• Promises survive bankruptcy. If a debtor's privacy policy prohibited transferring personally identifiable information to unaffiliated persons and was in effect when the case began, the trustee may sell that information only consistently with the policy, or after a consumer privacy ombudsman is appointed, notice and a hearing are held and the court approves (11 U.S.C. 363).
• A confidential list may be a protected business asset. Whether a particular list qualifies as a trade secret depends on state and federal law and on how carefully the business guarded it. That question belongs with counsel, and it cuts both ways: a list worth protecting is also a list a seller should not hand to strangers.

How the rules apply in common situations

Use this table to frame the conversation with counsel. The right-hand column is a typical starting point, not a conclusion.

The companion page on what happens to customer data when a business is sold covers the transaction side in more depth.

Why SourceX does not license customer lists

SourceX connects companies with AI labs and data buyers who license business records for training and evaluation. A customer list is mostly personal data about other people, gathered for a different purpose, and the company rarely holds a basis for licensing it. Mainly consumer personal data with no licensing basis is one of the red flags that stops a referral before qualification starts.

There is also a commercial reason: buyers are not shopping for contact data. Developers building AI agents need records of how work gets done, with steps, decisions and outcomes. A spreadsheet of names and emails shows none of that.

The same logic covers records that belong to a company's clients rather than to the company. Agencies, outsourcers and processors often hold data they have no right to license; the guide on distinguishing company data from data owned by its customers sets out the test, and the page on selling a marketing agency shows how it plays out in one industry.

What can an owner license instead?

Most established companies hold operational records that are their own work product. Any personal details inside them are handled under de-identification and redaction rules the company signs off on before work starts.

To be a fit, the company also needs to clear the baseline: a US business with 50+ full-time employees at peak (contractors excluded), several years of documented operations, rights to the records and an executive who can authorize a license. The who qualifies page sets out the full criteria.

Disclosure and consent good practice

• Pull every version of the privacy policy and terms that applied while the data was collected, not just the current one.
• Map each customer segment to its source: web sign-ups, trade show scans, purchased lists, partner referrals.
• Search customer contracts and NDAs for clauses that make customer identity or transaction data confidential.
• Treat any plan to reuse customer data for a new purpose as a change that may need fresh notice or consent, decided with counsel.
• Keep the list out of emails, data rooms and introductions unless counsel has cleared the recipient and the purpose.

Questions to ask your counsel

• Which privacy policy version governed each part of the list when it was collected?
• Does a state privacy law cover this data, and would this transfer count as a sale or a share under it?
• Are any customers covered by financial or health privacy rules?
• Do customer contracts, NDAs or data-vendor terms restrict disclosure?
• Is the list protected as confidential business information, and would a sale or license weaken that protection?
• If the business is being sold, how does the purchase agreement describe the list and any limits on its use?

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

Next step

If the real question is whether a company's data has value, look past the customer list. Run the business through the company fit checker, a preliminary, non-binding screen, or have the owner apply at sourcex.si/apply. Advisors who know eligible US companies can register as a partner and make the introduction while the records stay with the company.