Who is allowed to sell you data.

Why data is not a normal good

Almost everything you can buy can be resold by almost anyone. Connectivity is an exception, and for reasons that are more coherent than they first appear.

A mobile network runs on spectrum, which is a finite public asset that states allocate rather than sell outright. On top of that, governments have attached a set of obligations to anyone carrying communications: the ability to assist lawful interception, to route emergency calls, to identify subscribers, to retain certain records, to meet quality and consumer-protection standards, and to be taxable in a specific place.

None of those obligations can be enforced against an anonymous reseller. So regulators do the only workable thing: they license the participants, and they make the licence a precondition for touching the service at all.

A telecom licence is not really permission to sell. It is the state identifying someone it can hold responsible.

The logic underneath the rules

The four rungs, from spectrum to shopfront

The industry's vocabulary is unhelpfully full of acronyms, but the structure underneath is simple. There are four positions, and they differ by one question: how much of the network do you actually operate?

• MNO
  Holds spectrum, operates radio towers and the core network. The only rung that can exist without renting anything from anyone. Licences are scarce, expensive and awarded nationally.
• Full MVNO
  No spectrum, but operates its own core elements — including its own subscriber identity range, meaning it issues its own SIMs and profiles. It rents radio access from a host operator. Because it holds subscriber identity, it carries most of an operator's obligations.
• Light MVNO
  Controls brand, pricing, packaging and customer billing. Everything technical runs on the host. Faster and far cheaper to launch; correspondingly less independent.
• Reseller
  Sells a licensed operator's product under that operator's licence and name. Usually requires no telecom licence of its own — the obligations sit upstream, and the contract governs everything.

What actually triggers a licence

The line between "reseller, no licence needed" and "you are now operating a telecom service" moves between jurisdictions, but the tests regulators apply cluster around a consistent set of questions.

1. Do you hold subscriber identity?Issuing your own SIMs or profiles under your own identity range is the single clearest trigger. It means the network's record of who a subscriber is now points at you.
2. Do you operate network elements?Running core infrastructure that authenticates users or routes their traffic generally puts you inside the regulated perimeter.
3. Do you terminate or carry traffic?Especially voice and messaging, which attract interception, emergency-service and numbering obligations that data alone sometimes does not.
4. Are you contracting with the end user, in-country?Some regimes care less about your infrastructure and more about whether the customer's contract is with you, inside their borders.
5. Are you building your own facilities?Many countries split licensing into facilities-based and services-based tiers, with sharply different capital, ownership and reporting requirements for each.

What comes attached to the licence

A licence is rarely a single permission. It is a bundle of continuing duties, and the cost of the bundle — not the application fee — is what actually determines whether a rung is viable for a given company.

Read that list from the perspective of a small business selling connectivity alongside its main trade — a travel agency, a hotel, a rental counter — and the conclusion is immediate. None of them can carry this. The obligations have to sit with someone else, and the small seller has to be structurally downstream of that someone.

The traveller breaks the model

Everything above assumes a customer who lives, buys and uses the service in one country. Travel connectivity does not look like that, and this is where genuine ambiguity begins.

A traveller in Kerala buys a profile for use in Vietnam. The purchase happens in India. The network capacity is Vietnamese. The seller may be incorporated in a third country entirely. Three jurisdictions have a plausible interest, and they will not necessarily agree about which of them governs what.

Broadly — and this is a generalisation with real exceptions — the position tends to separate into two:

• Country of consumption
  Where the radio network actually is. This is where telecom licensing, interception and subscriber-identification duties overwhelmingly sit, and they attach to the licensed operator whose network carries the traffic.
• Country of sale
  Where the transaction and the customer relationship are. Obligations here are usually commercial rather than telecom — consumer protection, data protection, tax — because no network is being operated locally.

That distinction is why selling a foreign-use travel profile is frequently not treated as operating a telecom service in the country of sale. It is also why nobody sensible treats that as a settled rule. Regimes differ, positions shift, and the safe assumption is that this question has to be answered per market rather than once.

Why this shapes the entire distribution problem

Step back and the commercial implication is sharper than the regulatory detail.

Because obligations attach to licensed entities, every party in a connectivity chain has to be positioned relative to somebody's licence. A travel agency cannot simply buy megabytes and sell them. It has to sit downstream of an entity that is permitted to supply them, under a contract that makes clear where each duty lands: who verified the customer, who holds the records, who is liable if something goes wrong, who is taxable where.

This is the real reason connectivity distribution is harder than distributing almost anything else in travel. Hotel rooms, tickets and insurance all have their own regulatory texture, but none of them require you to establish, for every single border crossed, which state's telecom regime is implicated and which licensed party is answering for it.

In most industries the border is a logistics problem. In connectivity it is a legal one, and it recurs at every hop.

Why the chain is short and the market is fragmented

It also explains the market's shape. Chains stay short because each additional party raises the question again. Coverage stays uneven because entering a market means understanding its regime before selling a single unit. And small sellers — the ones actually standing next to travellers — are locked out entirely unless someone upstream has built a structure that carries the obligations for them.

What a distribution layer has to absorb

Everything in this piece points at the same conclusion, and it is not a regulatory one. It is an architectural one.

If thousands of small businesses are going to sell connectivity to travellers — and they are the only parties close enough to the decision to do it well — then the licensing burden cannot sit with them. It has to be absorbed upstream, by infrastructure designed around the question rather than surprised by it: capacity sourced from properly licensed operators in each market, obligations mapped explicitly to the party that can carry them, identity verification handled where the rules require it, and settlement that produces a clean, auditable record of who supplied what to whom, in which jurisdiction.

That is not a compliance checklist bolted onto a product. It is the specification of the layer itself. The technical problem of moving a profile across a border was solved a decade ago. The question of who is allowed to — and how thousands of small sellers can operate inside the answer — is the one still being built for.