May a business sell my data to third parties?
Only with explicit + specific consent. "Sold" is not only for cash — sharing for advantage counts too. AP priority. Fines up to 4% turnover.
Selling data = separate processing with separate basis. GDPR and Tw + sector laws recognise no automatic "data is sellable" concept. What counts as "selling"? (1) Money or credit for data transfer. (2) Barter deal: your data for discount code or partner bonus. (3) Bulk exchange between partners for ad targeting. (4) "Lookalike audience" transfer to Meta/Google. What is required? Explicit, specific, free, informed consent (Art. 7 + 4(11)). "Accept terms" = not sufficient. Separate checkbox per partner or partner category. When IS data sharing allowed without consent? (1) Processor relationship (DPA — not "sale"). (2) Legal obligation. (3) Vital interest. (4) Joint controllers with JCA. Recent AP fines: 2023-2024 hundreds of thousands of euros for energy + telco companies that sold member lists without consent. Your routes: (1) Request access "to which parties sold/transferred + basis" (Art. 15). (2) Objection (Art. 21) — for direct marketing absolute. (3) Erasure request at third parties (see data-sold protocol). (4) AP complaint — fines Art. 83(5) up to €20m / 4%. (5) Damages claim Art. 82 (CJEU 2023-2024: low threshold).
Sources
🔎 Common search variants
Recognise your own search? Our answer above covers these too.
- “business sell data gdpr”
- “my data sold”
- “lookalike audience consent”
- “data broker netherlands”