Can a company under an FTC consent order license its data?

Sometimes, but only counsel reading the order can say. An FTC consent order can prohibit or attach conditions to selling, sharing or using defined categories of data for as long as the order remains in force. Advisors should ask about any order before an introduction: covered data stays out, while unrelated operating records may still qualify.

The short answer: only the order's text can settle it

An FTC consent order does not automatically bar a company from licensing data, but it can. Each order is negotiated for one company, and its definitions decide which information is covered and what the company may do with it. Some orders say nothing that touches internal operating records; others prohibit or condition selling, sharing or licensing a defined category of consumer data.

For an advisor, the practical answer is a sequence: find out whether an order exists, have counsel read its definitions and prohibitions against the proposed scope, and keep covered data out unless counsel confirms in writing that a license is allowed.

What the FTC has said about data promises and AI training

Even outside an order, FTC staff have been explicit about AI-related data use. In a January 2024 post, the agency's technology staff wrote that a company's promises not to use customer data for undisclosed purposes, such as training or updating models, are enforceable whether they appear in a privacy policy, terms of service or marketing materials. A February 2024 staff post added that adopting more permissive practices, such as sharing consumer data with third parties or using it for AI training, and disclosing the change only through a surreptitious, retroactive amendment to the terms or privacy policy may be unfair or deceptive.

Both are staff posts published under the FTC's previous leadership, not rules. They still frame the question. A consent order resolves allegations about a company's practices and layers specific obligations on top of whatever its privacy policy already promised. The separate question of what a we-do-not-sell-your-data promise means for licensing applies to every company, with or without an order.

What a consent order can contain

Orders vary, but the provisions that matter for a data license tend to fall into a few groups. Read each one against the proposed scope.

Provision	What it can do	What to check for a license
Definitions	Name the categories of information the order covers	Whether operating records, employee data or customer content fall inside them
Prohibitions	Ban selling, sharing or disclosing covered data, sometimes for stated purposes	Whether a license to a data buyer is a covered disclosure
Consent requirements	Require affirmative express consent before certain uses or sharing	Whether valid consent exists for the records in scope
Deletion duties	Require deleting data, or products built from it	Whether any record proposed for licensing should no longer exist
Program and assessments	Require a privacy or security program and outside assessments	Whether the program's vendor and sharing approvals apply
Reporting and recordkeeping	Require compliance reports and records of certain activities	Whether a license must be documented or reported
Successors and term	Bind successors and set how long obligations last	Whether an acquirer is bound, and whether the order is still in force

Deletion duties can reach beyond raw data. The guide to algorithmic disgorgement explains the concept and why it matters for anything later built on the same records.

How it applies in common situations

Situation	What to check	Typical outcome to confirm with counsel
Order covers consumer location or browsing data; the proposal covers internal Slack, tickets and finance records	The order's definition of covered information	Unrelated internal records may be discussable; covered data stays out
Order requires express consent before sharing covered data with third parties	Whether the company ever obtained that consent for the records in scope	Without documented consent, covered data is excluded
Order required deletion of certain data	Whether any copies or derived datasets survived	Anything that should have been deleted cannot be licensed
Order arose from a security failure and contains no sharing ban	The mandated program's vendor and data-transfer controls	A license may be possible, run through the program's approvals
Order binds successors and the company was acquired	Whether the order names successors and assigns	The acquirer's records may carry the same limits
The order's term has ended	Any obligations stated to survive, plus current privacy promises	Old commitments to customers can still restrict use

For sell-side work, this is the same diligence a buyer's counsel will run. Any order, state attorney general settlement or consent decree belongs in the data room and the disclosure schedules, and it shapes what the company can say about its data. Advisors who run sale processes are well placed to surface it early.

Why advisors should ask before the introduction

Rights review is part of SourceX's qualification, so an order will come up anyway. Raising it first saves the sponsor from investing time in a data inventory that counsel later narrows. It also tells you whether the opportunity deserves the client's attention: if covered data makes up most of what the company holds, it may not.

One opening question does the work. Ask whether the company, or any business it acquired, is subject to an FTC order, a state attorney general settlement or another consent decree that touches data. If the answer is yes, the next conversation is with the company's counsel, not with SourceX.

Questions to put to the company's counsel

Which categories of information does the order define as covered, and do any proposed record sets fall inside them?
Does the order prohibit or condition licensing, selling or disclosing covered data to third parties?
Did the order require deletion of any data, and has that been completed and documented?
Do the order's program, assessment or reporting obligations apply to a data license?
When does the order expire, and do any obligations survive it?
Do the company's privacy policy and customer contracts add limits beyond the order?

Disclosure good practice for the referring advisor

Keep your role narrow. Tell SourceX that an order exists and which part of the business it relates to, and let the company's counsel handle the substance. Do not forward the company's records, compliance reports or assessments. Tell the client that you would receive a referral reward if a deal closes, and check your own firm's rules on outside compensation.

If a license does close, partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, paid only after the buyer pays and SourceX receives its fee. No reward is guaranteed.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

Next step

If the order leaves meaningful records outside its scope, run the company through the company fit checker and compare it with the who qualifies baseline. Then register as a partner and make the introduction with the order disclosed up front. Where the issue is litigation rather than an order, see privacy class actions and data licensing.

Step 1Share your linkSend your personal link to a company you know.
Step 2Company appliesThe company applies itself at /apply.
Step 3Buyer selects and paysThe buyer selects and pays for the data and SourceX receives its fee.
Step 4You get your rewardYour share of SourceX fees becomes payable.

Common questions

Does a state attorney general settlement raise the same issue?

It can. State settlements, assurances of discontinuance and court-entered consent decrees may contain their own limits on selling, sharing or using data, sometimes in different terms from any federal order. Treat each one the same way: identify it early, have counsel compare its definitions with the proposed scope, and exclude anything it covers.

If the order covers one product line, can records from the rest of the business be licensed?

Possibly. Orders define the information they cover, and records outside that definition may be discussable. Counsel has to confirm the reading, check whether the order's program or reporting duties still apply to the transaction, and make sure covered data is filtered out of any inventory before anything is shared with SourceX or with buyers.

Does an expired consent order still matter?

Check two things. Some obligations can be written to survive the main term, and the company's privacy policy and customer terms apply on their own. FTC staff have said that promises not to use customer data for purposes such as model training are enforceable wherever they were made, so an expired order does not erase earlier commitments.

Should the order be mentioned in the first introduction email?

Yes, briefly. Say that an order exists and which part of the business it relates to, without attaching filings or compliance reports. Rights are reviewed during qualification, so disclosing it up front avoids wasted inventory work and lets SourceX and the company's counsel decide quickly whether a narrower scope is worth pursuing.

How does an FTC order affect the partner's referral reward?

Only indirectly. Rewards follow closed deals: partners earn 25% of the eligible platform fees SourceX collects, up to $100,000 per referred company, paid after the buyer pays and SourceX receives its fee. If the order excludes most of the useful records and no deal closes, no reward is paid.

Free resources

Operational data inventory builder — List systems, record types, years held and owners.
AI readiness assessment — Ten questions, five dimensions, a score out of 100.
EBITDA calculator — Reported and adjusted EBITDA from net income.
All free tools · MCP resource center

By SourceX Partnerships Team · Published 2026-10-09 · Updated 2026-10-09

Know a US company with valuable proprietary data?

Become a referral partner from anywhere we support, get your link and introduce an owner or authorized decision-maker.

Refer a company →

I own a business

Explore licensing your company's data to AI developers worldwide. Start a short assessment; no uploads needed.

Start an assessment