Personal data: Property or commodity in Islamic finance?

Every day, individuals unknowingly surrender fragments of themselves – search histories, purchase records, location trails, liked posts, and late-night social media scrolls. These micro-traces are collected, processed, and transformed into substantial commercial value, prompting a critical question: Is personal data property or a commodity?

Technology platforms no longer merely sell products to users; they trade user profiles. The scale of this trade is immense. Meta, for instance, reported $201 billion in revenue in 2025, with approximately 97% derived from advertising, fueled by user data and attention. Google, Meta, and Amazon collectively dominate over 62% of global digital ad spending. This economic model underscores that human behavior has become a new source of wealth, with our data among the cheapest supplies.

This phenomenon raises urgent questions for Islamic finance and Sharia governance: Can personal data and the outcomes of algorithmic profiling be considered legitimate 'mal' (property) under Sharia law? Classical fiqh (jurisprudence) defines 'mal' as requiring 'tamawwul' (having monetary value) and 'taqawwum' (recognized value by Sharia). Under the Hanafi school, classical 'mal' typically involves objects with clear boundaries, whether tangible or intangible. Personal data, however, is abstract, continuously harvested, and dynamically transformed by artificial intelligence algorithms.

Users play overlapping roles: the original source of data, the subject of analysis, a commercial product, and a beneficiary of digital services. While commercializing information shares similarities with classical contracts like 'bay' al-ma'lumat' (sale of information) or 'ijarah al-manafi' (lease of usufruct), modern algorithmic monetization goes further. Platforms build psychographic predictive models and sell targeted access without full user comprehension or absolute consent. The Shafi'i school, emphasizing clarity in contracts, would find this retrospective data harvesting problematic.

Given this uncertainty, the legal status of data monetization should currently be classified as 'shubhah' (doubtful). This classification should persist until its structure is examined through new 'ijtihad' (independent legal reasoning) grounded in the 'maqasid al-shariah' (higher objectives of Islamic law), rather than merely extending classical 'qiyas' (analogical reasoning) approaches. Several fiqh principles support this stance. Firstly, contracts are judged by their true essence and economic impact, not their labels ('al-ibratu fi al-uqud li al-maqasid la li al-alfaz'). Calling a scheme a data collaboration or loyalty reward doesn't make it Sharia-compliant if it involves unfair value extraction. Secondly, profit must be accompanied by risk-bearing ('al-ghunm bi al-ghurm'). Arrangements that maximize platform revenue while transferring risk are questionable.