Do privacy promises follow data in an acquisition? What M&A advisors should know

Do privacy promises follow data in an acquisition?

Often yes. Counsel generally treats a company's pre-deal privacy promises as continuing to attach to the personal information it collected under them, so a buyer inherits the constraints along with the assets. For an M&A advisor, that means an acquired or wound-down company's customer records may be licensable only within what its old privacy policy allowed.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

This page sticks to what the statute and published FTC staff guidance say and does not recount individual enforcement matters. If you want the historic ones, ask counsel to pull them.

What does the law say when a company is in bankruptcy?

The Bankruptcy Code gives the clearest statutory example. Under 11 U.S.C. section 363, if the debtor disclosed a privacy policy prohibiting transfer of personally identifiable information to unaffiliated persons, and that policy was in effect when the case began, the trustee may not sell or lease the information unless the sale is consistent with the policy or the court approves it after appointment of a consumer privacy ombudsman, notice and a hearing.

The ombudsman role is defined in 11 U.S.C. section 332: one disinterested person, chosen through the US trustee on the court's order, who must be appointed not later than seven days before the hearing. In plain terms, customer data can be sold in bankruptcy, but privacy promises constrain how.

A reported 2025 example is the privacy ombudsman in the 23andMe bankruptcy, who recommended that any transfer of customers' genetic or personally identifiable data require renewed opt-in consent. That shows the scrutiny such sales draw. We do not state how that case concluded.

Does the same logic apply outside bankruptcy?

The principle carries over as a practical rule: promises made when data was collected govern later use, and a buyer should not assume it can rewrite a policy and apply the change backwards to data already collected. FTC staff have said that retroactive, surreptitious changes to privacy terms to allow uses such as AI training may be unfair or deceptive; that is staff guidance, not a rule. Counsel will usually test any proposed new use against what customers were told at the time.

What does this mean for an M&A advisor?

You are close to the moments when records change hands or systems are retired. Three situations come up. A sell-side client wants to understand what its customer data can be used for. A buyer is diligence-testing the target's records. A closing business is about to delete archives. In each, the promise attached to the personal data is a first-order question. For the role-level view, see referral opportunities for M&A advisors.

Operational records that contain no personal data of customers, such as internal SOPs, engineering documentation and finance workflows, usually face fewer promise-related constraints than customer files. Mention that to the client, and note that how a company's data is valued is a separate question, covered in how a company's data is valued.

How should you raise it with a client?

What should you check in diligence?

• Every version of the privacy policy and when each took effect.
• Terms of service and customer contracts that restrict reuse, as in confidentiality clause use restrictions.
• Whether employee data is involved; see CCPA employee data exemption expired and do you need employee consent.
• Which state laws apply, using the 2026 state privacy law map.
• Whether a court, trustee or assignee controls the data and has been involved.
• Whether the data was already licensed for AI training.

Counsel should run the final review. The company fit checker offers a preliminary, non-binding screen without contact details.

When is this a stop sign?

Stop when the main asset is consumer personal information collected under a policy that forbids transfer, when a bankruptcy court has not been involved and should be, or when archives have been deleted. A company with strong operational records and no such issue may still qualify.

Next step

If a client has 50+ full-time employees at peak (contractors excluded), documented operations and an authorized sponsor, register as a partner and introduce it. Partners earn 25% of the eligible platform fees SourceX actually collects, capped at $100,000 cumulative per referred company, and only after the buyer pays and SourceX receives its fee. Rewards are not guaranteed. Advisors should first check their own rules on referral fees and disclosure. See how SourceX referrals work.