Who Sells Your Personal Data, Is It Legal, and How to Stop It

What "selling your data" actually means

Hardly anyone sells a spreadsheet with your name on it for a lump sum. The trade is quieter than that. It’s a feed of location pings from an app, a licence to a marketing list, a data-sharing deal in exchange for ad space, or a tracking pixel that sends what you do on a website to an ad company.

The law has caught up with that. California’s privacy law counts as a “sale” any disclosure to a third party “for monetary or other valuable consideration”, so money doesn’t have to change hands. It also has a separate word, “sharing”, for handing data to someone else for cross-context behavioural advertising, paid or not (CCPA, §1798.140). That’s why a shop’s website with nothing but ad trackers still shows a “Do Not Sell or Share My Personal Information” link.

What gets sold:

• Who you are: name, home address, phone number, email, age, relatives.
• Where you go: precise location from your phone or car.
• What you do: browsing history, app use, purchases, how you drive.
• What they guess: income bracket, health interests, “likely to move”, “new parent”. These inferences are often worth more to buyers than the raw data.

The GDPR has no word for “sale” at all. To EU law, selling is just one more way of disclosing data, and it needs a legal basis like any other.

Who sells personal data

Data brokers are the obvious answer, and they’re only part of it. Much of the data on the market was collected by a company you dealt with directly, for a reason that sounded harmless at the time.

Most of these cases follow one pattern: data collected for one purpose (roadside help, a weather forecast, virus protection) ended up sold for another. In the GM case, the FTC said the data went to consumer reporting agencies whose reports insurers used to deny cover and set prices (FTC, January 2026). Many drivers only found out when their insurance price went up, The New York Times reported in 2024.

Your internet provider belongs on the list too. In 2017 Congress scrapped the FCC rules that would have required US broadband providers to get your opt-in consent before selling your browsing history. What a US provider does with that history now depends on its privacy policy and your state’s law.

Is it legal to sell personal data?

In the United States

Mostly yes. There’s no general federal privacy law, so selling personal data is allowed unless a specific rule says otherwise. The exceptions are narrower than people expect:

• Sector laws cover credit reports, children under 13, and health records held by doctors and insurers. A period-tracking app or a DNA kit isn’t a doctor, so its data usually falls outside health-privacy law.
• The FTC can act when a company lies about what it does with data, or when selling it causes harm people can’t avoid. That’s the basis of the Avast, Kochava and GM cases in the table above.
• Foreign adversaries. Since 2024, data brokers may not sell personally identifiable sensitive data about Americans to China, Russia, Iran or North Korea, or to companies they control. A Justice Department rule in force since April 2025 adds limits on bulk data deals with those countries.
• State privacy laws give you the right to opt out of the sale of your data. We count 24 states with such laws; our state privacy law checker shows which ones apply to a given business. California goes furthest, with opt-outs for “sharing” too and a CCPA regulator that fines companies.

Four states (California, Vermont, Texas and Oregon) also make data brokers register, which is how we know who most of them are.

In the EU and the UK

The GDPR doesn’t ban selling data, but it makes it hard to do quietly. A company needs a legal basis for every disclosure. For handing your data to other companies for their marketing, that usually means your consent. Whoever receives the data has to tell you where it came from, and you can object to direct marketing at any time, with no reasons needed: once you object, they have to stop (GDPR, Articles 14 and 21).

The French regulator showed how that works in practice in December 2024, when it fined Kaspr €240,000. Kaspr’s browser extension collected LinkedIn users’ contact details, including those people had restricted to their own connections, and sold access to about 160 million contacts. The CNIL found it had no legal basis for the restricted ones and hadn’t told people properly (CNIL).

The UK’s GDPR has the same rules.

What "Do Not Sell or Share" and Global Privacy Control do

The “Do Not Sell or Share My Personal Information” link is a California requirement for businesses that sell or share personal data, and many companies show it to everyone. Using it tells the company to stop selling or sharing your data from now on. Under California’s rules they have 15 business days to comply, and they may not ask for ID to process an opt-out.

It doesn’t delete anything, it doesn’t recall data already sold, and it doesn’t stop the company using your data itself. For deletion you need a separate request.

Global Privacy Control (GPC) sends the same request automatically from your browser to every site you visit. Twelve states now make businesses treat it as a valid opt-out, California included. Brave and DuckDuckGo’s browser send it by default, and Firefox has a setting for it; Chrome, Edge and Safari need an extension such as Privacy Badger (globalprivacycontrol.org). From 1 January 2027, a California law requires every browser maker to offer the setting.

Regulators do check. Ignoring GPC signals or making opt-outs work on one device only has cost Sephora, Healthline and Disney between $1.2 million and $2.75 million in California settlements (enforcement list).

How to stop companies selling your data

None of this stops all of it, but each step shuts a channel.

1. Turn on GPC in your browser. It costs nothing and opts you out on every site in the states that honour it.
2. Cut off your phone’s advertising ID. On an iPhone, turn off “Allow Apps to Request to Track” under Settings > Privacy & Security > Tracking. On Android, search Settings for “Ads” and delete your advertising ID. Location brokers link their data to that ID.
3. Limit location permissions. Give apps location only while you use them, and switch off precise location for apps that don’t need it. A weather app works fine with your town.
4. Opt out where you have accounts. Your phone carrier, car maker (look for “connected services” or “data sharing” in the app), supermarket loyalty programme and streaming services all have privacy settings or a “Do Not Sell” page.
5. Deal with data brokers. If you live in California, the state’s free DROP tool sends one deletion request to over 600 registered brokers. Everyone else opts out site by site; our data broker removal guide has the steps and the main sites.
6. In the EU or UK, use your rights. Object to direct marketing, and ask a company that contacts you out of the blue where it got your details. It has to tell you.
7. Read the “sale” section before you sign up for a DNA test, a connected car service or a free app. If the privacy policy says it sells or shares data, assume your data is on the market.

Can you sell your own data?

You can, and companies will pay, but don’t expect much. Market-research panels, receipt-scanning apps and browser extensions that report your browsing pay in points, prize draws or a few dollars a month. Nielsen’s Computer & Mobile Panel, for example, offers prize draws: “Nielsen gives away $10,000 each month” across its members (Nielsen).

Two things to weigh before you sign up. These apps tend to collect more than an ordinary app, because the data is the product. And read what they do with it next: many pass it on to their own clients, so you’d be paid once for data that gets sold many times.

Data brokers, for their part, don’t pay you for what they already have.