Is selling data a Stripe restricted business?
It depends on the data. Selling personal or scraped social-media data is restricted; consented, aggregated, or first-party B2B data products are processable. Where Stripe draws the line.
Verdict: it depends on the data. Personal information without the subject’s consent — scraped profiles, bulk contact lists, purchased databases — is the restricted pattern. Consented first-party data and non-personal data products are processable.
The source. Stripe’s restricted businesses list covers the sale or distribution of personal information without consent among its restricted categories. Unlike credit repair (a category verdict), data selling is a sourcing verdict — the same “data product” positioning can be fine or restricted depending on where the rows came from.
The sourcing table
| What you sell | Sourcing | Reviewer’s read |
|---|---|---|
| Scraped social-media profiles / contact enrichment from scraping | No subject consent, platform-terms violations | Restricted |
| Purchased or resold third-party contact databases | Consent chain unverifiable | Restricted |
| Opt-in lead generation (form discloses sharing) | Documented consent | Processable |
| Your own first-party audience data, disclosed in your privacy policy | First-party consent | Processable |
| Aggregated / anonymized analytics, market research | Not personal data | Processable |
| Non-personal data feeds (financial, weather, geo, product data) | Not personal data | Ordinary SaaS |
Two edges worth naming:
- “Publicly available” is not consent. A public LinkedIn profile is still personal data; the person did not consent to being packaged into a sales database. Public visibility answers a copyright question, not the consent question the restriction asks.
- Enrichment inherits the problem. If your API decorates an email address with scraped identity fields, you are distributing the scraped data — the input sourcing, not your product architecture, sets the category.
What reviewers look for on your site
Data businesses get reviewed through their public pages, the same way every category does. The reviewer wants the lawful-basis story answered before they ask:
- Where the data comes from — a sourcing statement (“collected from opt-in forms on our properties” / “aggregated from public market feeds”), not silence.
- Consent mechanics — for personal data: how subjects opted in, and how they opt out or request deletion.
- What a row contains — sample schemas or docs. Hiding the fields reads as having something to hide.
- Privacy policy consistency — a privacy policy that contradicts the product (“we never share personal data” on a data-selling site) is an instant flag.
If your data product is legitimate, these four items are also your conversion page — enterprise buyers ask the same questions as risk teams. The free scan checks whether your policy pages exist and say something substantial; the sourcing story is yours to write.
If the sourcing is the restricted kind
There is no wording fix for unconsented personal data — the fix is upstream, in the product:
- Move to consented collection (opt-in panels, first-party properties) and document it; the category verdict changes with the sourcing.
- Aggregate and anonymize so rows no longer identify people — genuinely, not “we removed the name column.”
- Failing both, the honest infrastructure is the high-risk specialist tier, with the same reserve and pricing trade-offs described in the restricted businesses guide — and the same warning about serial mainstream accounts.
Frequently asked
- Is selling scraped social media data restricted?
- Treat it as yes. Scraped profile data is personal information collected without the subject's consent — the pattern Stripe's restriction describes — and it usually violates the platform's terms on top.
- Can I sell leads on Stripe?
- Lead generation with disclosed consent (the person filled a form knowing their info would be shared) is widely processed. Bulk contact lists of people who never opted in are the restricted pattern.
- Are API data products safe?
- APIs selling aggregated, anonymized, or non-personal data (market stats, weather, financial feeds) are ordinary SaaS. The question is always whether rows identify people and whether those people consented.
- Does GDPR/CCPA compliance make data selling processable?
- It helps but is not sufficient by itself. Reviewers look for a lawful basis story on your site: where data comes from, consent mechanics, and opt-out. Silence about sourcing is read against you.