Nonprofits & AI Data Licensing: Donor Privacy and the UBIT Royalty Exclusion

Yes. Mode's BizBuyData program accepts nonprofits in its general category, currently 30 or more employees. What you can license is how your staff run grants, programs, volunteers and finance; donor and beneficiary records stay out. The income may fall under UBIT's royalty exclusion, but that turns on the contract, so have your CPA review it.

Do nonprofits actually qualify?

Mode says so. Its October 13, 2026 release names "Businesses, Nonprofits" in the headline, and Dan Novaes said on The LFG Show that "even nonprofits count." The headcount bar is the same as for general businesses.

Mode's application asks for full-time desk employees separately from non-desk employees. Volunteers, board members and most program staff in the field are not desk employees. Novaes said value comes from "the amount of employees" doing "white collar work" (5:03). A 40-person organization with 12 office staff is a weaker fit than its total headcount suggests. Confirm the threshold during intake.

What operational data does a nonprofit have?

Buyers want to see how work gets done, not who your donors are. Novaes said labs "don't care about who your customers are," and that identifying details get transformed (4:36). For a nonprofit, the workflow record includes:

• Grant workflow: drafts, internal reviews, budget revisions, submission checklists and reporting calendars.
• Program coordination: planning documents, staff email and chat, and handoffs between program and operations teams.
• Volunteer operations: how shifts get filled, gaps covered and changes communicated, with volunteer contact details removed.
• Board preparation: agenda drafting and packet assembly. Executive-session and personnel material should stay out.
• Finance and accounts payable: invoice approvals, expense coding and month-end close. Mode's program page lists QuickBooks, NetSuite and Paychex among its sources.
• Internal IT and HR workflows: help-desk tickets, onboarding checklists and policy manuals.

What should stay out?

Mode says identifiers are removed or transformed before onward delivery. The safer choice is to keep these systems out of scope entirely. De-identification addresses what the final buyer sees, not whether you were permitted to disclose the information to begin with.

There is a precedent for carving out records about the public. In the Spirit Airlines bankruptcy sale, the court-appointed consumer privacy ombudsman recommended approval of Google's winning $10 million bid after passenger databases were excluded and a third party, Tonic.ai, was hired to de-identify other data, Business Insider reported. Her review did not cover employees. The sale still needs court approval; the hearing was moved to November 6, 2026 (Travel Weekly). The ombudsman's report also flagged children's data, recommending that it be considered for exclusion, according to Stretto's docket summary. Youth-serving organizations should take that seriously.

How does UBIT apply to data licensing income?

This is a question for your CPA or exempt-organizations counsel. Here is the framework they will use.

Unrelated business income tax applies to net income from a trade or business, regularly carried on, that is not substantially related to your exempt purpose. The tax rate is 21%, per Steptoe. The IRS says an organization with $1,000 or more of gross unrelated business income must file Form 990-T.

Two statutory exclusions in 26 U.S.C. §512(b) may matter:

Steptoe's analysis of IRS guidance makes the central point: "royalty" is not defined by statute, a royalty must relate to the right to use an intangible asset, payments for services do not qualify, and the actual nature of the income controls, "rather than the designation of the income by the parties." Courts have treated some mailing-list rentals as royalties. In a 2020 technical advice memorandum, though, the IRS treated a charity's payments as services income because the charity did much of the work and the contract read like a service agreement.

Facts that should help a royalty or property characterization: Mode does the export and filtering, your staff spend only a few hours on scope and sign-in, and the contract is drafted as a license or sale of a data copy. Mode describes the deal as buying "an agreed copy" for which your team mainly reviews scope. Facts that could hurt: ongoing obligations to curate, label or explain data. Read the draft agreement with your advisor before you sign, not after.

What about donor privacy and trust?

Many nonprofits fall outside the California Consumer Privacy Act, which generally applies to for-profit businesses. That is not a free pass. Your privacy policy, donation pages and fundraising communications may promise not to share or sell information, and those promises are what donors and regulators will hold you to. Laws covering health, education and children's data apply regardless of tax status.

Then there's staff. Emory law professor Ifeoma Ajunwa told Business Insider that whether employees' consent extends to the sale of their data is "an ethically gray area." Mission-driven staff may object more than most. Tell them before you sign, and be ready to explain where the money goes.

How should you explain it to donors, staff and funders?

Assume the deal will become known. In Business Insider's reporting, a Spirit Airlines vendor learned from the media that its data could be sold, and employees rarely know when their work records are. A nonprofit's reputation is its fundraising base. Decide your explanation before you sign, not after a donor asks.

• Lead with what was not shared. Donors care most about their own records. Being able to say plainly that donor, beneficiary and grant-restricted data were excluded, and showing the board-approved scope, answers the first question.
• Say where the money goes. Licensing income that funds programs or reserves is easier to explain than income with no stated use. Decide with the board whether it is unrestricted revenue.
• Tell staff first. Their emails and chat are the corpus. Explain what is included, how identifiers are handled, and whether anyone can ask for specific channels or date ranges to be left out.
• Check with major funders. Some funders care about data practices as a condition of support, and some grant agreements give them rights over data created with their money. A short note to program officers before announcement avoids a surprise.
• Update your privacy policy if needed. If your current policy says you never share or sell information, decide with counsel whether the deal fits within it or whether the policy needs an update first.

None of this is required by Mode. It is what protects the organization if the deal is questioned later.

What could a nonprofit be paid?

No public figure is specific to nonprofits.

Mode says its calculator "is illustrative, not a guaranteed offer." It reviews systems and dates in scope, years of history, record volume and quality, and ownership terms before making a fixed offer. Excluding donor and beneficiary systems shrinks the corpus. See our methodology for how the estimate below works.

How long does it take?

Mode's release describes a 14-day nonbinding letter of intent with one 7-day extension at Mode's request, then 15–30 days of collection and de-identification after you accept the final offer, with payment "expected within approximately 60 days." Mode's program FAQ now says about three months from first conversation to payment. Board calendars rarely move that fast. Build the board review into your timeline, and don't let a buyer's deadline skip it. Our process guide covers each step.

What should an executive director check before signing?

• Board approval of the scope, tax analysis and privacy review.
• Privacy policy and donation-page promises about sharing information.
• Grant agreements for data ownership, use and confidentiality terms.
• Tax review of the draft contract under §512(b)(2) and §512(b)(5).
• A written, system-by-system scope that excludes donor, beneficiary and restricted data.
• Filtering evidence. Mode's release says it built its own PII-removal tools after other vendors would not let it audit theirs. Ask for sample output.
• Insurance. Novaes said Mode was "working on" a third-party insurance policy for potential data leaks. Ask whether it exists.
• Staff notice.

Our risk checklist goes deeper on each item, and our guide to data licensing as non-dilutive capital compares this income with grants, loans and other funding.

Who are we?

DataLicensingAudit is an independent referral partner of Mode. If your organization signs after we introduce it, Mode may pay us a referral fee; your payment does not change. See our disclosure. We are not a CPA firm and do not give tax or legal advice. Consult your CPA and counsel.