Restricting the sale of personal data

The US experience

In February 2025, the state of Vermont introduced a bill relating to consumer data¹ privacy and online surveillance. Since the US is now the only jurisdiction where the sale of personal data is regulated at the state level, the bill provides users with special rights when their data is sold by companies of two categories: companies that processed data from of not fewer than 25,000 consumers and companies that processed data of not fewer than 12,500 consumers and derived 25% of gross revenue from the sale of personal data.

Companies must provide the user with the opportunity to opt-out of the sale to third parties or used in targeted advertising or digital profiling. Companies must provide, upon request, a list of third parties to whom data has been shared. The practice of selling personal data is recognized as a high risk to data subjects, so companies are required to conduct a data protection assessment and disclose the results of such internal audits upon request of the state attorney general.

The bill fits in the trend of restricting the sale of personal data, set in 2018 when the state of California adopted requirements for companies to provide users with the right to optout of the sale of their data to third parties. Today, many states are passing personal data laws that tighten the terms and conditions under which personal data is sold, such as Virginia (Consumer Data Protection Act of 2021), Utah (Consumer Privacy Protection Act of 2022), and Colorado (Privacy Act of 2023). The requirements effectively restrict large companies from selling data against the will of the user, preventing such companies from monopolizing the market by accumulating large amounts of data.

Russia’s experience

Russian legal practice does not use the concept of “sale of personal data”, but this does not exclude the problem of gray schemes for trading in Russians' data. For example, in 2020, 9.2 mn records on bank customers were offered² for sale in the banking sector. The main source of data for sale is leaks resulting from cyber attacks: in 2023, 170.3 mn records leaked from³ the banking sector. Thus, there is a shadow market of personal data trading in Russia, the⁴ main beneficiaries of which are fraudsters.

However, user data is also of interest for legitimate business, for example, for use in marketing purposes. Therefore, working out legitimate grounds for transferring personal data between companies on a commercial basis is relevant in Russia. It is noteworthy that the national development goals of Russia until 2030 set the task of forming a data market, which⁵ could potentially include personal data.

From the monitoring issue No. 2 (14), February 2025. Download the full issue (PDF) · issue page at the Gaidar Institute