Proprietary Data Moats: When Data Actually Protects a Startup

A proprietary data moat is a competitive advantage built on data that only your product collects through normal use, and that rivals cannot buy, scrape or synthesize. It matters when the data either makes the product better or is needed to deliver it at all. Data anyone can obtain is an input, not a moat.

The idea is popular because it sounds inevitable: more users, more data, better product, more users. In practice most "data moats" are public data with a database in front of it. This page covers when data really protects a company, the strongest argument that it usually does not, and how Moat Check scores it.

Why it matters for startups vs big companies

For a big company, data is often a byproduct of scale. Google sees more searches than anyone, so it learns more from them. A startup has the opposite problem. It has almost no data on day one, and a large competitor can usually buy, license or scrape more of any generic dataset than the startup ever will.

That shapes what a startup should look for. It cannot win on volume. It can win on a type of data the incumbent does not collect, because the incumbent's product does not sit in the right place in the workflow. A small company that owns the moment an outcome happens (a claim is paid, a loan defaults, a patient responds to a drug) can hold data that a company 100 times its size cannot get.

It also matters because AI has lowered the cost of copying software. If a rival with the same AI model and an empty database can match you, the model was never your edge. That is the question behind the beyond the AI model test, and proprietary data is the most common honest answer to it.

The skeptic's case: are data moats real?

The best-known critique is The Empty Promise of Data Moats by Martin Casado and Peter Lauten of a16z (2019). Their argument, in short:

• Most claims about data defensibility "actually boil down to scale effects," not true network effects.
• "There generally isn't an inherent network effect that comes from merely having more data."
• Data has diminishing returns. In their words, "the cost of adding unique data to your corpus may actually go up, while the value of incremental data goes down!"
• A new entrant often only needs a "minimum viable corpus" to start, which weakens the head start of the incumbent.

They conclude that "treating data as a magical moat can misdirect founders from focusing on what is really needed to win." This is a useful filter. A data moat is real only when three things hold: the data is hard to get, it keeps getting more valuable (or stays perishable, so the gap never closes), and a competitor cannot reach "good enough" with a smaller, cheaper dataset. Most startups fail the third condition. The survivors tend to have the specific types below.

Types of proprietary data

1. Outcome-labeled data. Not just what happened, but how it turned out. A transaction marked fraudulent after a chargeback, a loan that defaulted, a treatment that worked. Labels are the expensive part of machine learning, and real-world outcomes cannot be synthesized.
2. Transactional data. Records of money, orders or contracts that pass through the product. If the transaction happens inside your system, you see it; if it happens on someone else's platform, they do (see owned customer relationships).
3. Local and perishable data. Traffic right now, prices this week, which store has stock today. Its value decays fast, so a rival cannot catch up by buying an old copy. You have to keep collecting it.
4. Exhaust data. Clicks, corrections, dwell time and other signals generated as a side effect of using the product. Weak alone, strong in aggregate and in context.
5. Regulated or permissioned data. Health records, financial accounts, insurance claims. Access requires trust, contracts and compliance, which slows down copycats for years.

Proprietary vs scrapable, purchasable or synthetic

12 real examples

• Google Search. The 2025 remedies ruling in the US antitrust case ordered Google to share certain search index and user-interaction data with qualified competitors, a sign of how much the court thought click data mattered.
• Waze. Google paid $1.1 billion for Waze in 2013, when it had about 50 million users feeding it live, perishable traffic reports.
• Tesla. Tesla says its global fleet "can collect the equivalent of over 500 years of continuous driving data per day" and that its FSD model is trained on customer and Robotaxi data (Q4 2025 update).
• Stripe Radar. Radar's fraud models are trained on more than 70 trillion data points across the Stripe network, and Stripe says there is a 92% likelihood a charge comes from a card it has already seen. That is outcome-labeled transactional data.
• Flatiron Health. Roche bought the oncology software and real-world evidence company for $1.9 billion in 2018. The asset was curated clinical data from the practices using its records software.
• Verisk ISO ClaimSearch. Insurers contribute claims to a shared fraud database that now aggregates over 1.9 billion claims. A contributory pool like this is hard to replicate because the members are the data source.
• Reddit. Google agreed to pay roughly $60 million for access to Reddit content for AI training. Freshness and structured access were the product; the deal includes real-time access through Reddit's Data API.
• Zillow. Zillow publishes the Zestimate's error rates, and they are much lower for homes currently listed for sale than for off-market homes. The gap shows how much fresh listing data matters.
• Duolingo. Its Birdbrain model predicts whether a learner will get an exercise right, and "the more exercises all of our learners complete, the more Birdbrain learns" (Duolingo blog).
• Strava. Strava Metro gives aggregated, de-identified activity data to city and trail planners. It is exhaust data from athletes that no survey could match.
• Bloomberg. The Terminal had about 325,000 subscribers as of 2022. Its strength is less any single dataset than the network, messaging and workflow built on top of it.
• Recorded Future. A useful counterexample. Mastercard agreed to buy it for $2.65 billion, yet much of its raw input comes from the open web, dark web and technical sources. The value was in collection, curation and customers, not exclusive raw data.

How a startup builds it from zero

1. Pick a data type before you pick features. Write down which outcome or transaction your product will see that nobody else does. If you cannot name it, you do not have a data strategy yet.
2. Sit where the outcome happens. Flatiron collected data because oncologists ran their practices on its software. Being a reporting layer on top of someone else's system is weaker than being the system.
3. Capture labels as a side effect. Make corrections, approvals and results part of the normal workflow so users label data without extra work. A "was this right?" button that nobody clicks does not count.
4. Start narrow. One vertical, one city, one customer type. Dense data in a small market beats thin data everywhere, and it is how a winnable starting market turns into a data advantage.
5. Earn the right to the data. Contracts, consent and compliance are part of the moat. Regulated data is defensible precisely because access is slow to get.
6. Prove it improves something. Track one metric (fraud caught, match rate, prediction accuracy) against data volume. If the line is flat, see the data flywheel test before claiming a moat.

Common mistakes and fake data moats

• "We have a lot of data." Volume is not a moat if a rival can buy or scrape the same thing. Ask where it came from.
• Public data with a nicer interface. Aggregating listings, filings or reviews is useful, but anyone can rebuild the scraper.
• Data you do not own. If the data lives in a customer's CRM or a platform's API, the platform can revoke access or change the terms.
• Data with no outcome. Logs of what users looked at, with no record of what happened next, rarely improve a model enough to matter.
• "At scale" thinking. A moat that only appears after ten million users is a plan, not a moat.
• Ignoring diminishing returns. As the a16z essay argues, the next 100,000 examples are often worth far less than the first 1,000.

How Moat Check scores it

The test asks: "Does normal use create data competitors can't buy, scrape or synthesize?" Scoring follows the methodology: pass is 10 points, partial is 5, fail is 0.

• Pass (10). Normal use generates outcome-labeled, local or perishable data that is unavailable elsewhere, and that is true today or by design of the product.
• Partial (5). The data could become proprietary, but it only appears "at scale," depends on users doing extra work, is weak or easily approximated, or relies on access the company does not yet have.
• Fail (0). The data is public, purchasable or easily generated.

Moat Check uses AI and web research to apply this fixed framework to your idea. Treat the result as a starting point for your own thinking, not a verdict or investment advice. For the broader picture, read what a moat is.

Check your startup's moat

Questions

Keep reading

• The Data Flywheel: When Usage Makes the Product Measurably Better
• Switching Costs: Why Customers Stay, and How to Earn It
• Distribution Moat: How Startups Own Channels Rivals Can't Buy
• All 10 types of moats
• What is a moat in business?