Is it legal to buy ecommerce store data?

The line that matters: business facts vs personal data

Data law in most countries regulates information about identifiable people, not information about businesses as businesses. A store's domain, its ecommerce platform, and a contact address the business itself publishes so customers can reach it are business facts. The moment a dataset names a private individual — a person's own inbox rather than a role inbox — privacy law, consent rules, and much stricter duties attach, and a buyer's exposure grows with them.

That is why two products both sold as 'store data' can sit at opposite ends of the risk scale. Ask any seller what a record actually contains: if the answer includes named personal emails, treat the product as a personal-data product whatever the marketing calls it, and apply the stricter standard — or walk away.

• Public business facts — lower risk: a store's domain and platform, the technologies it runs, and the business email or phone number it publishes on its own site for customers to use.
• Personal data — higher risk: a named individual's private or work email, direct-dial numbers, or anything collected from behind a login or in breach of a site's access controls.
• Grey in the middle: data that was public once but is sold without provenance, so you cannot show where it came from or when it was collected.

How OpenData stays on the safe side of that line

OpenData's rules are built around the business-facts category. Stores are scanned by OpenData itself from public storefront pages — no third-party lists are bought or copied, so provenance is never inherited from an unknown collector. Email addresses are restricted to business addresses a store publishes for contact — info@, sales@, support@, or the store's own named contact address — and addresses never published for contact are not collected or sold. Of the 1,504,744 verified stores, 205,297 have a public business email and 111,859 have a store-published phone.

Every record carries its source URL and the date it was last seen, so any row can be traced back to the public page it came from. And the exit is as deliberate as the entry: anyone can request removal through the data-removal page, removals are honoured within 48 hours, and the record is permanently suppressed from future exports. The full handling rules are set out in the privacy policy, and you can inspect a record's fields yourself in the free store checker.

Why provenance is the practical test

Principles are easy to state and hard to audit, which is why the practical test of a dataset is provenance: can the seller show, for a specific record, the public page it came from and the date it was collected? A seller who scanned public storefronts can answer instantly. A seller who aggregated other lists usually cannot, and that gap matters because a buyer who cannot show where data came from also cannot show it was collected lawfully — the risk of an upstream collector's methods travels with the file.

Provenance also disciplines the seller over time. When every record carries a source URL and a last-seen date, stale rows can be re-checked and dead stores dropped, and a store owner who disputes a listing can be shown exactly what was public and when. Datasets sold as one undifferentiated dump, with no per-record origin, offer neither protection. Before paying for any list — including this one — pull a sample, pick a few records at random, and visit the source pages yourself. The checker makes that free for OpenData records.

The buyer's responsibilities do not end at purchase

Buying data lawfully does not make every use of it lawful. What you do with a list — especially emailing it — is governed by the anti-spam and privacy law of the recipient's country, not the seller's. Some regimes are consent-first, Canada and Germany being the standard examples: do not send commercial email into them unless your legal basis is clearly established before you send, not argued afterwards.

Elsewhere the baseline duties are consistent: identify yourself truthfully, email only the business addresses the data actually contains, honour every opt-out immediately and permanently, and keep records of where the list came from. If a recipient asks how you got their address, a per-record source URL is the difference between an answer and an apology. When a campaign matters, get advice on the specific markets you are sending to — this page explains principles, not any one country's statute.

Questions to ask any data seller before you pay

A seller operating on the safe side can answer all of these without hesitation. OpenData publishes its answers in advance: records are public business facts with source URLs, emails are the business addresses stores publish for contact, nothing is bought or copied from third parties, removals are permanent within 48 hours, and the store count — 1,504,744 verified against 1,554,041 tracked — counts only storefronts fetched and matched to at least one detected ecommerce technology. You can test the claims cheaply with a free sample before looking at the pricing page, where records are priced per row with no subscription.

• What exactly is in a record — business facts, or named personal data?
• Where did each record come from — can the seller show a source URL per record?
• Was anything bought in from third-party list brokers, and if so, from whom?
• Which email types are included — published business contacts only, or private addresses too?
• How are removals handled, how fast, and are they permanent?
• How fresh is the data, and what does the headline store count actually count?

Questions, answered straight

Next steps