The Ethics of Data Sales: Where to Draw The Line

Is it ethical for companies to sell personal data? Sometimes—but only when individuals understand what is being collected, have meaningful control over it, and the sale does not expose them to unreasonable risks.

The ethical line should generally be drawn where informed consent, transparency, necessity and user control end.

Selling aggregated market information can create legitimate economic value. Secretly selling someone’s precise location, medical interests, browsing activity or other sensitive information is fundamentally different.

A useful ethical test is:

Consent + Transparency + Necessity + Security + User Control = More Responsible Data Use

If a company cannot clearly explain what it collects, why it collects it, who receives it and how consumers can exercise their rights, monetizing that information becomes much harder to justify.

The issue is increasingly important because apparently harmless datasets can reveal surprisingly intimate details. The U.S. Federal Trade Commission (FTC) has warned that browsing and location information can reveal health conditions, financial circumstances, religious affiliations and other highly sensitive aspects of people’s lives.

Where Should We Draw the Line on Selling Data?

The fundamental question shouldn’t be simply:

“Can we legally sell this data?”

It should be:

“Would people reasonably expect us to do this with their information?”

1. Meaningful Consent Should Be the Starting Point

Consent is one of the clearest places to draw the ethical boundary. Imagine downloading a weather application. You reasonably expect it to use your location to provide:

Weather information for your location.

You might not reasonably expect:

Location → Data broker → Advertiser → Analytics company → Unknown third parties

especially if that chain wasn’t clearly disclosed.

The OECD’s privacy principles say:

“There should be limits to the collection of personal data.”

The organization also states that information should be collected through lawful and fair means and, where appropriate, with the individual’s knowledge or consent. But merely clicking “I Agree” shouldn’t automatically make every subsequent data use ethically acceptable.

Meaningful consent should be:

• Informed.
• Specific.
• Understandable.
• Freely given where applicable.
• Easy to withdraw where required.
• Obtained before unexpected secondary uses.

A 12,000-word privacy policy that virtually nobody understands may technically disclose something without providing meaningful transparency.

2. Companies Should Collect Less Data

Another ethical principle is surprisingly simple:

If you don’t need it, don’t collect it. The European Commission describes this GDPR principle as data minimisation.

Personal information should be:

“adequate, relevant, and limited to what is necessary”

for the stated purpose.

Suppose a calculator app wants:

Your contacts + Precise GPS location + Microphone + Browsing history

Why?

Those permissions appear unrelated to performing calculations. Compare that with a navigation app requesting location information. Location is central to the service.

Ethical data collection should therefore follow:

Purpose → Minimum required data

rather than:

Collect everything → Find a commercial use later.

3. Sensitive Data Deserves a Much Higher Standard

Not every piece of information creates the same risk. Knowing that someone likes football is different from knowing that the same person regularly visits:

• A medical clinic.
• A religious institution.
• A domestic-abuse shelter.
• A political gathering.
• A rehabilitation facility.

Location information can reveal these patterns without explicitly containing a person’s medical record or religious affiliation. This isn’t theoretical.

In 2024, the FTC finalized an order prohibiting X-Mode and its successor Outlogic from selling or sharing sensitive location information following allegations involving precise data capable of tracking visits to locations including medical and reproductive-health clinics and places of worship.

The case demonstrates an important ethical principle:

Sensitivity isn’t determined only by what a database column is called. It also depends on what can be inferred from the data.

Read Also: The Legality of Data Sales: Protecting Privacy While Earning

4. “Anonymous” Doesn’t Automatically Mean Harmless

Companies sometimes argue that data is safe because names have been removed.

But:

No name ≠ No identity risk

A dataset might contain:

Device ID + Location history + Timestamp

without containing:

John Smith

Yet if one device spends every night at the same house and every weekday at the same office, linking it to an individual may become considerably easier.

The FTC has emphasized this issue, explaining that browsing and location datasets can remain sensitive even when they don’t contain conventional identifiers such as names or Social Security numbers.

The ethical question is therefore not simply:

“Did we remove the person’s name?”

It is:

“Could this information reasonably be connected back to an individual or used to reveal sensitive characteristics?”

5. Purpose Matters

Suppose you provide your email address to receive an electronic receipt.

That’s Purpose A.

Later, the company sells your address to multiple unrelated marketing businesses.

That’s Purpose B.

The original transaction doesn’t necessarily imply meaningful agreement to the second activity.

This concept is known as purpose limitation.

European Commission guidance says organizations should identify the specific purpose for processing personal information when collecting it. Using information for another purpose may require determining whether that new use is compatible with the original one.

The OECD similarly says subsequent uses should generally remain limited to the original purposes or compatible purposes, subject to appropriate consent or legal authority.

An ethical company should therefore ask:

Would the customer be surprised by this secondary use?

If the answer is yes, greater transparency and appropriate permission may be needed.

6. Consumers Should Have Real Control

People should not need a computer-science degree to understand where their information goes. Reasonable controls can include the ability to:

1. See what information is collected.
2. Understand why it’s collected.
3. Know relevant categories of recipients.
4. Correct inaccurate information where applicable.
5. Withdraw consent where applicable.
6. Request deletion where legally provided.
7. Opt out of qualifying sales or sharing where applicable.

Control should also be practical.

A prominent:

ACCEPT ALL

button combined with several confusing screens required to reject tracking creates a questionable power imbalance.

Good privacy design makes the privacy-protective choice understandable and accessible.

7. Data Brokers Carry Special Responsibility

Data brokers can assemble information from multiple sources. The danger is that individually insignificant pieces of information become revealing when combined.

Imagine:

Shopping history + GPS movements + Search activity + Demographics + Device identifiers

Individually, each dataset tells part of the story. Combined, they can potentially build an extraordinarily detailed profile.

In December 2024, the FTC alleged that Gravy Analytics and Venntel had collected and sold sensitive location information. The complaint stated that the companies claimed to process more than 17 billion signals from around one billion mobile devices daily.

Separately, the FTC alleged that Mobilewalla had sold sensitive location information without taking reasonable steps to verify consumer consent. A final order banning the company from selling sensitive location data was approved in January 2025.

These cases illustrate how scale changes the ethical stakes.

8. Security Is Part of Data Ethics

If a business profits from personal information, it also assumes responsibility for protecting it.

The OECD’s Security Safeguards Principle says personal information should have reasonable protections against risks including unauthorized access, destruction, use, modification and disclosure.

Consider a company earning $10 million from a valuable consumer database while spending almost nothing securing it. Even if every customer originally consented, inadequate protection raises a separate ethical issue.

Responsible monetization therefore requires:

Collection → Protection → Controlled use → Appropriate retention → Secure deletion

Data shouldn’t be kept forever merely because storage is cheap.

The Five-Question Ethical Data Test

Before selling or sharing personal information, organizations can apply a straightforward framework.

A company failing several of these questions should reconsider the transaction.

The Business Case for Ethical Data Practices

Privacy isn’t necessarily the enemy of innovation.

The OECD explicitly recognizes that privacy can help support data sharing and the creation of economic and social value, while its Privacy Guidelines seek to create a trust-based data ecosystem.

Similarly, NIST describes its Privacy Framework as a voluntary tool helping organizations manage privacy risks while continuing to develop innovative products and services.

The objective therefore doesn’t have to be:

Data economy vs privacy

A better model is:

Useful data + Responsible processing + Consumer protection + Innovation

Trust itself can become a competitive advantage.

Final Words

Personal information has become an important economic resource.

It powers:

Advertising + Artificial intelligence + Market research + Personalization + Analytics + Product development

But the fact that information has commercial value doesn’t mean every possible use is ethically defensible.

The FTC’s enforcement activity illustrates the stakes. Its cases have addressed allegations involving location information revealing visits to healthcare facilities, religious organizations and other sensitive locations.

Meanwhile, established international frameworks provide a useful ethical foundation. The OECD emphasizes collection limitation, purpose specification, use limitation, security, openness and accountability, while European data-protection principles emphasize fairness, transparency, purpose limitation and data minimisation.

The ethical line can therefore be summarized simply:

• Collect what you need.
• Explain why you need it.
• Don’t quietly repurpose it.
• Protect what you collect.
• Give people meaningful control.
• Treat sensitive information differently.

And perhaps the most useful question of all:

If every customer knew exactly what you were doing with their data, would you still be comfortable doing it?

If the answer is no, that’s probably where the line should be drawn.

FAQ

Is selling personal data legal?

It depends on the jurisdiction, type of data, parties involved and circumstances of collection and sale. Privacy laws differ significantly. Something being lawful also doesn’t automatically settle whether a particular use is ethical.

Is anonymous data safe to sell?

Not automatically. Removing names reduces certain risks, but detailed datasets may sometimes be linked back to individuals or reveal sensitive characteristics. The risk depends on the dataset and safeguards used.

What data should never be sold?

There isn’t one universal rule covering every jurisdiction, but precise location, health information, financial information, children’s data and information revealing highly sensitive characteristics warrant particularly strong protection.

Should consumers be paid when companies sell their data?

Compensation can improve the value exchange in voluntary data marketplaces, but payment doesn’t eliminate ethical responsibilities. Companies still need transparency, appropriate consent, security and limits on harmful secondary uses.

Where should companies draw the line?

A practical boundary is reached when monetization involves unexpected uses, inadequate consent, unnecessary collection, sensitive information, insufficient security or loss of meaningful individual control.

Source: devprojournal.com