The biggest red flags in a data broker are fees before any sale, no say over who buys your data, no written license terms and no re-identification testing. A good broker checks your rights before it asks for data, shows you exactly what leaves your company, and gets paid only when a license is signed.
The list below is our view, built from how we run deals and from the doubts we wrote down while researching this market. Use it on any broker, including us.
Money red flags
Fees before anything sells
A broker that charges setup, listing or "data preparation" fees up front gets paid whether or not a buyer exists. Commission-only brokers carry the risk with you. We take a commission on each license, and if nothing sells, you pay nothing. If a broker does charge up front, ask what you get if no buyer appears.
Gross deal value reported as revenue
A broker earns its commission, not the full price a buyer pays. When a broker advertises its revenue, check whether the number is its own share or the gross value of deals it brokered. Inflated revenue numbers say little about how well sellers are paid. We report our own revenue as our commission, never gross deal value.
One-off sales called "MRR"
Monthly recurring revenue means money that arrives every month under an ongoing agreement. A one-time license for a data dump is a single payment, however large. If a broker describes one-off sales as MRR, ask how many sellers get paid every month and for what. Real recurring income needs a refresh term in the license and a way to deliver new data on a schedule. Our page on recurring data revenue describes how ours works.
Payout promises with no buyer
Be careful with any broker that promises a specific amount or a payment date before a buyer has seen a sample. Price depends on buyer demand, which comes in bursts tied to labs' training plans. Our calculator gives an indicative range, and we confirm it on a call and again after a buyer reviews the sample.
Rights red flags
No contract review
A broker should ask about your rights before it asks for your data. Customer agreements, data processing agreements and confidentiality clauses can block a sale even after scrubbing. If you hold the data on behalf of customers, you usually need their written permission. A broker that skips this step leaves the legal risk with you. See can I sell data I hold for my customers.
No answer on controller vs processor
Ask the broker whether you are the controller or the processor for the data you want to sell. If it can't explain the difference, it hasn't thought through whether your sale is lawful. Under Article 28(10) of the GDPR, a processor that decides its own purposes for data is treated as a controller for that processing.
Privacy red flags
"We remove names" as the whole privacy plan
Removing names doesn't make data anonymous. Latanya Sweeney found that 87% of the US population was likely unique on ZIP code, gender and date of birth alone. Business records have their own combinations: a company domain with a job title, an unusual invoice amount on a given date, an invoice number. Ask the broker how it handles these quasi-identifiers and whether it generalizes rare values. Our guide to de-identification vs anonymization covers the methods.
No re-identification test
A broker should test whether any record can be singled out before every sale and keep the report. Ask to see the report for your sample. We return a readiness report with the re-identification result before any buyer sees your data.
Raw data leaves your company by default
Ask where scrubbing happens. If the broker needs a full copy of your raw systems on its servers, your exposure is higher. With our SDK, scrubbing runs on your machine and only the scrubbed output and scrub report are uploaded. The exception is a sample for the readiness report, uploaded under NDA; our server scrubs it, keeps only the scrubbed output and report, and deletes the raw file.
Secrets and free text go out unchecked
Exports often contain API keys, passwords, internal hostnames and free-text notes with personal details. A careful broker excludes credentials, security logs and unreviewed free text by default.
Control red flags
You can't approve buyers
You should know who buys your data and be able to say no. Some sellers want to rule out competitors; others want to rule out a specific lab. We require your approval for every buyer before a license is signed, and you can exclude any company.
No written license terms
Ask to see the buyer license before you sign anything. At minimum it should state the allowed uses (training, fine-tuning, evaluation), ban re-identification, ban resale and combining with other data, set an end date, require deletion of raw data, give audit rights and bind anyone the buyer passes the data to. Our guide to data licensing terms explains each term.
No way to withdraw
Ask what happens if you want out. A fair agreement explains how withdrawal removes your data from future sales. It should also say plainly that data already licensed and used in training can't be pulled out of a trained model.
Process red flags
Silence after the first call
Data deals take weeks, longer when contracts need permission. A broker should show you the stage your deal is at and who owns the next step. We keep a deal room page per seller and send a short update every Friday. Our guide on how long a data deal takes walks through each stage.
No sector screening
Health, finance, government and export-controlled data need their own review or should be excluded. A broker that accepts everything without asking about your sector hasn't looked at the risk.
A short checklist
| Ask the broker | Good answer |
|---|---|
| Do you charge before a sale? | No, commission on licenses only |
| Who approves buyers? | You do, for every license |
| Can I see the buyer license? | Yes, before you sign |
| How do you test re-identification? | A test on every dataset, with a report you keep |
| Where does scrubbing happen? | On your machine, or on a sample under NDA |
| What revenue do you report? | Your own commission |
| How does recurring income work? | Refresh terms paid per delivered batch |
Ask us the same questions
Run this checklist on us. Start with the valuation calculator for a range, then read how we work on the seller hub and the trust page.
Frequently asked questions
Is it normal for a data broker to charge fees up front?
Some do, but it shifts the risk to you because the broker is paid whether or not a buyer appears. Commission-only brokers are paid only when a license is signed.
How do I know if a broker's de-identification is good enough?
Ask for the re-identification test result on your sample. Removing names is not enough, because combinations of fields like location, dates and rare amounts can still single people out.
Should I be able to choose who buys my data?
Yes. A broker should let you approve every buyer and exclude any company, including competitors.
What should a buyer license always include?
Allowed uses, a ban on re-identification, a ban on resale and combining with other data, an end date, deletion of raw data, audit rights and the same limits for anyone the buyer shares the data with.