What data can you legally sell?

This is a practical orientation, not legal advice — data law varies by jurisdiction and changes; for anything commercial at scale, talk to a lawyer. With that said: most would-be data sellers overestimate the red zone, underestimate the careful zone, and don’t know the escape hatch exists. Here’s the map.

The green zone: sell with confidence

Data you generated. First-party telemetry, measurements, research output, business records about your own operations, content you created. You own it; sell it. This is most of the long tail.
Your labor on open data. Public-domain and open-licensed data can be assembled, cleaned, and sold as a product — what you’re charging for is the assembly and maintenance, which is honest and common (there’s a live ask offering $25 for exactly such an assembly of public electricity prices). One rule: comply with the license. CC-BY needs attribution; share-alike (ODbL, CC-BY-SA) means your derived dataset inherits the license; and never imply exclusivity over data anyone can get free. The license field on your listing is where this gets declared.
Government/open data — usually free to reuse commercially, but check the specific terms (some national portals differ).

The careful zone: scraped public data

The US legal picture genuinely improved for scrapers of public pages: hiQ v. LinkedIn established that scraping publicly available data doesn’t violate the CFAA, and Meta v. Bright Data (2024) held that terms-of-service didn’t bind a scraper that never logged in. But “not hacking” isn’t “free to resell.” The traps that remain:

Contract: log in, click “I agree,” and ToS do bind you — hiQ ultimately lost on contract, not CFAA.
Copyright: facts aren’t copyrightable; expression is. Prices and specs are safer than scraped reviews, articles, or images.
EU database right: the EU protects “substantial” extraction from databases regardless of copyright — wholesale scraping of an EU-hosted database is its own violation.
Personal data lurking inside — which brings us to:

The red zone

Personal data without a lawful basis. This is the big one, and “it was public” is not a defense: GDPR applies to personal data regardless of public availability — Clearview AI scraped public photos and has collected over €91M in EU fines. Scraped emails, profiles, and faces are not sellable inventory. And beware: pseudonymized ≠ anonymized — if anyone could re-identify individuals, GDPR still applies. US state laws (CCPA and siblings) add sale-specific opt-out duties.
Data you licensed from someone else. Your upstream API’s terms almost certainly prohibit redistribution. Reselling a vendor’s feed with a markup is a contract breach with your name on the invoice.
Confidential material — trade secrets, data under NDA, your employer’s databases. Obvious, but it’s where the lawsuits with punitive damages live.

The escape hatch: sell the shape, not the records

When the underlying data is valuable but unsellable — personal, confidential, licensed — you can often legally sell a synthetic twin: a generated dataset preserving the statistical shape with no real records. That’s a legitimate product with real demand if the packaging is honest, which is why provenance is mandatory for synthetic listings here (method, source modeled, fidelity, privacy guarantee — e.g. differential privacy with a stated epsilon). Aggregation is the milder version of the same move: sell counts, indices, and trends derived from records you can’t ship raw. (Also on the horizon: the EU AI Act’s transparency rules for training data are making documented, cleanly-licensed datasets more valuable, not less — provenance is becoming a feature buyers pay for.)

The 60-second checklist before you list

Did I generate this, or does someone upstream have rights? (Check your API contracts.)
Is there personal data in any column? If yes, stop — anonymize properly, aggregate, or go synthetic.
If scraped: public without login? Facts, not expression? Not a wholesale EU database dump?
If built on open data: license complied with, attribution in the listing, license field set?
Would I be comfortable if the source saw the listing? (The gut check that catches what checklists miss.)

Green-zone data plus honest packaging is a real business with none of this anxiety — and it’s most data people actually have. Start: sell a dataset · synthetic data, packaged honestly