Is it legal to sell my business's client list?
Once business owners realize that it might be lucrative to pass along their client list to other companies, they often ask: Is it legal to sell my business's client list?
Business owners can sell their client lists as long as they comply with privacy laws and do not promise clients that they will not share their information. Some clients specifically request that you do not share their information. Other clients might assume that you will not share it, but you likely have no legal obligation to keep that information to yourself unless you have indicated that you would or a privacy law applies. Privacy laws that may apply in your area vary, but may generally require you to provide notice or an opportunity for clients or prospective clients to opt out of having their information collected, stored, sold, or shared.
Potential sources where you may have told clients that you will not share their information include:
- Website disclaimers.
- Confidentiality Agreements.
- Non-Disclosure Agreements.
- General Privacy Policies.
- Noncompete Agreements.
- Any contract with a client.
Review each document that governs your relationship with a client before you make a commitment to sell their information. Keep in mind that some states have strict data collection and sharing restrictions. Maine and California, for example, require customer consent to sell information for ad targeting. Some industries are prohibited from selling certain information as well. It is a good idea to ask a lawyer about the laws and regulations for your area and industry.
Do I need permission from clients to sell their information?
Federal law does not require a business to get permission to sell a customer's data. As a result, you generally do not need permission from a client to sell their data as long as your state's laws, or the client's state's laws (if they are in a different state), do not prohibit it. However, you may need to notify clients that you are collecting data and explain how you intend to use it, depending on the information you are collecting. If you do business worldwide, there may be additional regulations and requirements, such as the General Data Protection Regulation (GDPR) for the European Union.
Data privacy and protection laws may require that you get permission from anyone before you collect and sell their information. They might also require that you allow clients to opt out of having their data sold and require you to tell them exactly what data you are collecting.
Is it legal to buy client or lead lists from businesses?
It is generally legal to buy client or lead lists from businesses. North America alone has more than 200 companies that sell email lists. However, sending emails to certain contacts can be illegal, especially if they have not opted in to receiving those emails. Alternatively, calling someone on the National Do Not Call Registry can lead to penalties.
You can buy client or lead lists from one of the many companies that collect this information and sell it to third parties. You might also be able to buy them directly from other businesses. Companies that provide leads will often sell them by the thousand, and your company can call or otherwise contact them to solicit sales using whatever method you find appropriate and legal. When buying lead lists, however, be aware that they sometimes contain questionable information which can lead to serious concerns about whether the information is accurate and whether these contacts opted in to receive communications from third parties. If you contact someone who has opted out, especially using email, text, or phone, then you may run into legal trouble.
How can businesses protect their client lists when employees quit or are fired?
Because client lists are a valuable asset, some ex-employees might try to sell this information to others against your wishes, or contact your clients after starting at a new company. If you do not want this information shared or if you have committed to clients that you will not share their information, this can be a serious problem.
You can take steps to protect client information by:
- Ensuring passwords are changed when an employee leaves.
- Cutting off ex-employees' access to client information.
- Using an Employee NDA that prohibits employees from sharing client information.
- Creating a culture of privacy when it comes to client data (such as through aggressive Privacy Policies or regular use of Confidentiality Agreements).
An Employee NDA in and of itself does not prevent an employee from sharing information. Instead, it provides legal consequences to that employee, and potentially to a new employer, if the information is shared. In many cases, this agreement can be enough to force employees to think twice about stealing and sharing client data.
Get help selling or protecting client information by reaching out to a Rocket Lawyer On Call® attorney. An experienced lawyer may be able to work with you to help you determine what is legal, what is not, and what hoops you need to jump through to protect your business.
This article contains general legal information and does not contain legal advice. Rocket Lawyer is not a law firm or a substitute for an attorney or law firm. The law is complex and changes often. For legal advice, please ask a lawyer.
