Updated October 2026
Will my customers find out if I license our data?
Buyers say your customers should not be identifiable in what they receive: Nyne swaps client names for codes, Polyshares uses a third-party scrubbing partner, and micro1 says personal data is removed. Whether a customer ever learns you licensed records is a separate matter, and depends on your own agreements and disclosures.1,2,3
You are not alone
It is the first thing every owner asks
One broker built its whole ad around this worry. Your Data Value opens with "The first question most owners ask is whether their customers' private information would go out", and follows with "Customer details removed first". Nyne's engineering ad goes further: "Your CAD files, paid for. Clients protected."4,5
Even the largest proposed sale carved customers out. When Spirit Airlines' internal archive was put up for sale, passenger records were excluded and a consumer privacy ombudsman was appointed. What was offered was the airline's internal email and Teams traffic. The court has not yet ruled on that sale.6,7,8,9
What buyers do
How customer details are taken out
Three methods show up in buyers' terms. Swapping names for codes, so "Henderson Roofing" becomes "Client 0417" everywhere it appears (Nyne). Scrubbing by an outside specialist before the buyer sees anything (Polyshares). Removing whole categories, such as client-held data, which Polyshares excludes outright. Clova Data advertises 100% de-identified; Shfa.ai says it removes all 18 HIPAA identifiers from healthcare records.1,2,10,11,12
micro1's terms read two ways. An earlier description says personal data is removed when relevant; micro1's own partnership page now says sensitive information is scrubbed before any downstream use. It also says the company reviews samples before release, which is your chance to check.3,13
The honest limit
Why cleaning is never perfect
Removing names is not the same as making a record anonymous. Researchers showed that 99.98% of Americans could be re-identified in a dataset from 15 demographic attributes. In a small town, an email about "the dental office on Main with the flooded basement in March" may point to one customer even with the name gone.14
So do three things. Exclude your most sensitive customers' folders outright; Nyne's ads say any folder can be left out. Review the cleaned samples yourself before release. And get a ban on re-identifying people written into the license.15,13
Telling them
Whether to tell your customers is your call, with advice
Some owners will want to tell key clients before anyone else does. Press coverage has been sharp on the employee side, with headlines like "Your Former Employer Is Selling Your Slacks and Emails to Train AI", and customer-side stories could follow. Whether you must tell customers anything is a question for the licensing company before you sign; it is on the list below.16
FAQ
Questions, answered with sources
Sometimes. Research found 99.98% of Americans could be re-identified from 15 demographic attributes. Small, local businesses have more identifying details in their records.14
Nyne's ads say you can exclude any folder. Ask every buyer for the same and list the exclusions in the agreement.15
We do not answer legal questions. Ask the licensing company: their team reviews this with you before anything is signed.
We do not answer legal questions. Ask the licensing company: their team reviews this with you before anything is signed.
Before you sign
Legal questions go to the licensing company
We do not answer legal questions. Ask the licensing company before you sign: their team reviews these with you.
Questions for this kind of business
- Does our privacy policy or any customer agreement restrict licensing records that mention customers?
- Will the license ban re-identification of our customers, and what happens if it occurs?
- How do CCPA, GDPR, UK GDPR and state privacy laws apply, and is de-identified data still personal information?
- Do customer, vendor or platform contracts, NDAs or API terms restrict this?
Questions for any buyer
- Is the license exclusive, and for how long?
- Can you sublicense the data, and to whom?
- Which AI labs will receive it, and will you tell us?
- How long do you keep it, and how is it deleted?
- What is your liability cap, and who indemnifies whom?
- Will the contract ban re-identification of people in the data?
- Who removes personal data, by what method, and do we approve it first?