What you are ENTITLED to sell (GDPR & Monetization)

Before monetizing data, one question takes precedence over all others: do you have the right to sell it? (This guide simplifies established rules and does not constitute legal advice: for your specific case, consult your DPO, the CNIL, or a lawyer.)

Everything begins with a distinction: is the data personal? Data that allows a person to be identified, directly or indirectly, is personal and falls under GDPR (Art. 4(1)). Then comes a decisive nuance: anonymous data—that is, data rendered irreversibly non-identifying—is outside GDPR (Recital 26), while only pseudonymized data remains personal (Art. 4(5)). The CNIL requires three tests to speak of anonymization: impossibility of individualization, correlation, and inference.

To transfer personal data, a legal basis is required (Art. 6(1)): consent, or legitimate interest accompanied by a balancing test. Be aware, 'selling under legitimate interest' is not a general rule—it's case-by-case. Another pitfall: reselling data constitutes a new purpose compared to the collection (Art. 5(1)(b) and 6(4)); in practice, this requires new consent, and Terms of Service accepted 'in bulk' do not constitute consent (CNIL). Regarding prospecting, the electronic channel requires prior consent, while postal or telephone channels can rely on legitimate interest with the right to object.

B2B is not exempt from GDPR: a generic address like 'contact@company' is outside its scope (Recital 14), but a nominative email 'firstname.lastname@' or an employee's name remain personal data (CJEU, C-710/23); for a sole proprietor, 'company data' often identifies the person. Hence, a five-question checklist: is the data personal? Do I have a legal basis to transfer it? Is it compatible with the initial purpose? Are individuals informed and can they object? Are objectors excluded, with proof?

This is not theoretical: on May 15, 2025, the CNIL fined Solocal Marketing Services (€900,000) and Caloga (€80,000) for using and reselling prospecting data without a valid legal basis. The lesson: compliant data sells, non-compliant data incurs sanctions. Prioritize aggregated and anonymized data, and have your data qualified before putting it on the market.