PewterCan You Sell Customer Data Without Sharing Personal Information?
Yes, but the question contains a misconception worth correcting first. Most owners assume "customer data" means customer records, names included. What AI developers actually want is behavioral signal: the sequence of decisions, transactions and communications that show how work gets done. Identifiers, such as names, email addresses and phone numbers, are noise to a training model. Removing them before delivery is standard practice, and it resolves the concern that stops most owners from exploring this at all.
In short:
- AI developers want behavioral patterns, not personal identifiers. Names, emails and phone numbers are typically removed before any records leave your systems.
- De-identification replaces or strips identifying details, but no method removes every risk. You review a de-identified sample before signing anything.
- Nothing is licensed until you approve every term in writing. You can exclude regulated, privileged or third-party records entirely.
The misconception most owners carry into this conversation
When an owner hears "sell your company's data," the first image is a spreadsheet of customer names, addresses and purchase histories going to a stranger. That image is wrong for two reasons.
First, AI developers are not building mailing lists. They are training models to reason through complex tasks: routing a shipment, reconciling accounts, reading a set of construction drawings. To do that, they need examples of skilled humans working through those tasks step by step. The signal they want lives in your dispatch records, your workpapers, your email threads where a problem got solved. It does not live in the name of the person who placed the order.
Second, the question "can you sell customer data without sharing personal information" assumes the personal information has to travel with the behavioral record. It does not. De-identification separates the two before anything leaves your systems. What gets licensed is the pattern of work, not the identity of the people involved.
This distinction removes the most common objection owners raise. You are not selling your customers. You are licensing a record of how your business operated.
What de-identification actually does
De-identification is the process of removing or replacing details that could identify a specific person or company. Typically, names become consistent placeholders (Customer A, Vendor 7), email addresses are stripped or replaced with fictional ones, phone numbers are removed, and account numbers are replaced with codes that preserve the structure of a record without revealing who it belongs to.
The goal is to preserve the behavioral signal while eliminating the identifier. A dispatch record that shows a driver was rerouted after a delivery exception, with three messages between the dispatcher and the customer, is still useful to a training model after the customer's name and contact details are gone. The reasoning chain is intact. The identity is not.
No de-identification method removes every risk. A record with enough contextual detail can sometimes be re-linked to an individual, particularly if the buyer already holds other data about that person. This is a real limitation, and any honest account of the process has to say so. It is why you review a de-identified sample before signing, and why you have the right to exclude categories of records you are not comfortable with, including anything that touches regulated data, attorney-client communications or third-party contracts that restrict disclosure.
What records AI developers actually want
The records in highest demand are those that show skilled work unfolding in sequence. Logistics, accounting, engineering, construction, distribution and manufacturing firms generate exactly this kind of record.
| Record type | Examples | What the model learns |
|---|---|---|
| Communications | Email threads, dispatch messages, client updates | How decisions are explained and escalated |
| Operating records | Rate quotes, order history, delivery exceptions | How transactions are structured and resolved |
| Technical documents | CAD files, calculations, specifications, revisions | How complex problems are broken into steps |
| Financial workpapers | Reconciliations, models, tax files | How numbers are checked and conclusions drawn |
| Procedures | SOPs, training documents, project logs | How a firm's institutional knowledge is organized |
What is notably absent from that list: customer names, personal contact details, social security numbers, health information, payment card data. Those are not what buyers are training on. They are what buyers do not want, because they create legal exposure for the buyer and add noise to the training set.
Where the legal and privacy questions sit
This article is general information, not legal advice. Privacy law in the United States is a patchwork: federal sector-specific rules (HIPAA for health data, GLBA for financial data, FERPA for education records), state consumer privacy laws (California's CCPA being the most cited), and contractual obligations you may have taken on in your own customer agreements. Whether a particular set of records can be licensed, and under what conditions, depends on facts specific to your business. Ask your lawyer before you sign anything.
A few practical questions worth raising with counsel:
- Do your customer contracts restrict how you can use or share the data they generate with you?
- Does your business handle any category of data that falls under a federal sectoral law?
- Does your state's consumer privacy law define "sale" in a way that covers licensing to an AI developer, even after de-identification?
- Do your employee agreements address ownership of records generated in the course of work?
The answer to "can you sell customer data without sharing personal information" is partly a technical question (can de-identification be done adequately?) and partly a legal one (do your contracts and applicable law permit it?). Both need an answer before you proceed.
How the process works in practice
Pewter Data helps owners of established US firms license de-identified copies of business records to AI developers. The process starts with sizing: how many years of records exist, across which systems, at what volume. If the records fit what buyers want, Pewter brings a written offer from its licensing partner. The owner reviews the offer, the de-identification approach and a sample of processed records before signing anything. Nothing is exported until the owner approves every term in writing.
Identifying details about clients and staff are removed or replaced with consistent placeholders before delivery. The owner can exclude any category of records, including regulated data, privileged communications or anything covered by a third-party contract. The full export is coordinated with the owner's IT contact.
If a deal closes, Pewter's fee is 10% of the license price, shown on the paperwork before the owner signs. No deal, no fee. The owner can walk away at any point before signing.
Published deals from 2026 give a sense of what has traded. A licensing firm reported $350,000 for five years of workpapers, reconciliations, financial models and tax files from a 60-person accounting firm. The same firm reported $450,000 for CAD drawings, calculations, technical reports and specifications from a 70-person engineering firm. A freight brokerage with 100 employees received $650,000 for rate quotes, shipment documents, dispatch records and claims. These are other firms' deals, published by the licensing firms that handled them. Many firms are offered less. Some receive no offer.
Frequently asked questions
Is selling de-identified data the same as selling personal information?
Not in the technical sense. De-identified data has had personal identifiers removed or replaced. Whether it qualifies as a "sale of personal information" under a specific law depends on how that law defines both terms. California's CCPA, for example, has specific rules about what counts as de-identified data and what obligations attach to it. Ask your lawyer how your state's law applies to your records.
Can you sell customer data without sharing personal information if your contracts say you won't share customer data?
Possibly not without amendment or consent. Your customer contracts may restrict what you can do with records generated in the relationship, regardless of whether personal information is removed. A lawyer needs to review the specific language before you proceed.
Do AI developers ever ask for names and contact details?
The published deals and the structure of AI training suggest developers want behavioral and operational signal, not personal identifiers. Identifiers add legal exposure and reduce the usefulness of training data. That said, contract terms vary, and you should read any proposed license carefully before signing.
What happens if records are re-identified after delivery?
This is a real risk. De-identification reduces it but does not eliminate it. Once records are delivered under a signed license, the training cannot be undone. This is one reason to review the de-identification approach and a sample before signing, and to ask your lawyer what representations and warranties the license should include.
Does a closed or winding-down business still qualify?
Yes, if the records exist. Operating, winding down and closed firms all qualify. Firms that fit typically had 20 or more people at peak and have at least three years of records, mainly in English. These are general fit criteria, not hard cutoffs.
If you want a rough sense of what your records might support, the two-minute estimate calculator at /#estimate asks only headcount and years in business. It produces an indicative range from the licensing partner's payout model, described on the site as a scenario, not a valuation. For a fuller picture of rights, privacy considerations and contract terms to watch for, the free guide at /before-you-sell covers all of it, including an 18-question checklist to work through before you sign anything.
Find out what your records could be worth
Put your headcount and years in business into the Pewter calculator. It takes about two minutes, needs no files, and costs nothing.
General information, not legal, tax or insurance advice. Published deals cited here were reported by the firms that did them or by the press. Pewter did not advise on them, and many firms are offered less or receive no offer.